diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml new file mode 100644 index 0000000..0ee3415 --- /dev/null +++ b/.github/workflows/tests.yml @@ -0,0 +1,18 @@ +name: Sandblaster tests +on: + workflow_dispatch: # Manual trigger + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Set up Python 3.10 + uses: actions/setup-python@v3 + with: + python-version: "3.10" + - name: Run test script + run: python3 tests/test.py diff --git a/.gitignore b/.gitignore index c952d3c..98efb4c 100644 --- a/.gitignore +++ b/.gitignore @@ -20,5 +20,6 @@ TAGS *.pyc *.log *.bin +!tests/**/*.bin core .DS_STORE diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..1e7039e --- /dev/null +++ b/Dockerfile @@ -0,0 +1,16 @@ +FROM debian:bullseye + +RUN set -xe; \ + apt-get -yqq update; \ + apt-get install -y libstdc++6 python2.7 python3 python3-pip; \ + pip3 install lief; + +COPY helpers /sandblaster/helpers/ +COPY reverse-sandbox /sandblaster/reverse-sandbox +COPY sb_parser /sandblaster/sb_parser + +WORKDIR /sandblaster/sb_parser + +# apparently if you remove the 'make clean' line it goes bang :) +RUN make clean +RUN make diff --git a/sb_parser/.clang-format b/sb_parser/.clang-format new file mode 100644 index 0000000..d731bc1 --- /dev/null +++ b/sb_parser/.clang-format @@ -0,0 +1,7 @@ +BasedOnStyle: LLVM +IndentWidth: 4 +TabWidth: 4 +UseTab: Always +BreakBeforeBraces: Stroustrup +AllowShortIfStatementsOnASingleLine: false +IndentCaseLabels: false diff --git a/sb_parser/Makefile b/sb_parser/Makefile new file mode 100644 index 0000000..3bda41c --- /dev/null +++ b/sb_parser/Makefile @@ -0,0 +1,16 @@ +CXXFLAGS=-std=c++17 + +default: parser + +block.o: block.hpp block.cpp + +hasher.o: hasher.hpp hasher.cpp + +string_utils.o: string_utils.hpp string_utils.cpp + +parser: block.o hasher.o string_utils.o parser.cpp + +.PHONY: clean + +clean: + rm -rf parser *.o diff --git a/sb_parser/block.cpp b/sb_parser/block.cpp new file mode 100644 index 0000000..b9e60b7 --- /dev/null +++ b/sb_parser/block.cpp @@ -0,0 +1,147 @@ +#include +#include + +#include "block.hpp" +#include "hasher.hpp" +#include "string_utils.hpp" + +Block::Block(StringHasher &hasher) +{ + this->m_name = 0; + + this->m_hasher = &hasher; +} + +void Block::set_name(std::string str) +{ + this->m_name = this->m_hasher->hash(str); +} + +void Block::add_attr(std::string attr) +{ + this->m_attributes.push_back(this->m_hasher->hash(attr)); +} + +void Block::add_child(Block *other) { this->m_children.push_back(other); } + +std::string Block::to_string() +{ + std::string name = this->m_hasher->reverse_hash(this->m_name); + + std::string ans = "{\"name\": " + quote_string(name); + + ans += ", \"attributes\": ["; + if (!this->m_attributes.empty()) { + for (int attribute : this->m_attributes) { + ans += quote_string(this->m_hasher->reverse_hash(attribute)) + ","; + } + + ans.pop_back(); + } + ans += "], \"children\": ["; + if (!this->m_children.empty()) { + for (Block *child_block_ptr : this->m_children) { + ans += child_block_ptr->to_string() + ","; + } + ans.pop_back(); + } + ans += "]"; + + ans += "}"; + return ans; +} + +// todo maybe add comparator options here +int Block::compare_to(Block *other, bool skip_print) +{ + //* check name first + if (this->m_name != other->m_name) { + if (!skip_print) { + std::fprintf(stderr, "Block names differ: '%s' vs '%s'\n", + this->m_hasher->reverse_hash(this->m_name).c_str(), + other->m_hasher->reverse_hash(other->m_name).c_str()); + } + + return this->m_name - other->m_name; + } + + //* check attributes + //* check size first, if this fails, no need to sort + if (this->m_attributes.size() != other->m_attributes.size()) { + if (!skip_print) { + std::fprintf(stderr, + "Block attribute lengths differ: '%lu' vs '%lu'\n", + this->m_attributes.size(), other->m_attributes.size()); + } + + return ((int)(this->m_attributes.size())) - + ((int)(other->m_attributes.size())); + } + + //* check attribute values, sort first because order doesn't matter + std::sort(this->m_attributes.begin(), this->m_attributes.end()); + std::sort(other->m_attributes.begin(), other->m_attributes.end()); + + for (int i = 0; i < (int)(this->m_attributes.size()); ++i) { + if (this->m_attributes[i] != other->m_attributes[i]) { + if (!skip_print) { + std::fprintf( + stderr, "Block attribute #%d differs: '%s' vs '%s'\n", i, + this->m_hasher->reverse_hash(this->m_attributes[i]).c_str(), + other->m_hasher->reverse_hash(other->m_attributes[i]) + .c_str()); + } + return this->m_attributes[i] - other->m_attributes[i]; + } + } + + //* check children + //* check size first, if this fails, no need to sort + if (this->m_children.size() != other->m_children.size()) { + if (!skip_print) { + std::fprintf(stderr, + "Block children lengths differ: '%lu' vs '%lu'\n", + this->m_children.size(), other->m_children.size()); + } + return ((int)(this->m_children.size())) - + ((int)(other->m_children.size())); + } + + auto block_comparator = [](Block *i, Block *j) -> bool { + return i->compare_to(j, true) < 0; + }; + + std::sort(this->m_children.begin(), this->m_children.end(), + block_comparator); + std::sort(other->m_children.begin(), other->m_children.end(), + block_comparator); + + for (int i = 0; i < (int)(this->m_children.size()); ++i) { + int result = + this->m_children[i]->compare_to(other->m_children[i], skip_print); + + if (result != 0) { + if (!skip_print) { + std::fprintf( + stderr, + "Block child #%d differs: '%s' vs '%s' (see above error)\n", + i, + this->m_hasher->reverse_hash(this->m_children[i]->m_name) + .c_str(), + other->m_hasher->reverse_hash(other->m_children[i]->m_name) + .c_str()); + } + return result; + } + } + + //* if all checks pass, objects are equal + return 0; +} + +Block::~Block() +{ + for (Block *child_block_ptr : this->m_children) { + delete child_block_ptr; + } +} diff --git a/sb_parser/block.hpp b/sb_parser/block.hpp new file mode 100644 index 0000000..734b749 --- /dev/null +++ b/sb_parser/block.hpp @@ -0,0 +1,30 @@ +#pragma once + +#include +#include + +#include "hasher.hpp" + +class Block { + public: + int m_name; + std::vector m_attributes; + std::vector m_children; + + StringHasher *m_hasher; + + public: + Block(StringHasher &hasher); + + ~Block(); + + void set_name(std::string str); + + void add_attr(std::string str); + + void add_child(Block *child); + + std::string to_string(); + + int compare_to(Block *other, bool skip_print = false); +}; diff --git a/sb_parser/hasher.cpp b/sb_parser/hasher.cpp new file mode 100644 index 0000000..2c9eab5 --- /dev/null +++ b/sb_parser/hasher.cpp @@ -0,0 +1,35 @@ +#include "hasher.hpp" + +#include +#include +#include + +StringHasher::StringHasher() +{ + this->m_clean_id = 1; + this->m_hashmap = std::unordered_map(); + this->m_rev_hashmap = std::vector(); + + this->m_rev_hashmap.push_back("default-name"); // reverse hash of 0 +} + +int StringHasher::hash(std::string str) +{ + if (!this->m_hashmap.count(str)) { + this->m_hashmap[str] = this->m_clean_id; + this->m_rev_hashmap.push_back(str); + ++(this->m_clean_id); + } + + return this->m_hashmap[str]; +} + +std::string StringHasher::reverse_hash(int hash) +{ + if (hash > this->m_rev_hashmap.size()) { + throw std::runtime_error("cannot reverse " + std::to_string(hash) + + " : invalid hash"); + } + + return this->m_rev_hashmap[hash]; +} diff --git a/sb_parser/hasher.hpp b/sb_parser/hasher.hpp new file mode 100644 index 0000000..d4c1ebc --- /dev/null +++ b/sb_parser/hasher.hpp @@ -0,0 +1,19 @@ +#pragma once + +#include +#include +#include + +class StringHasher { + public: + int m_clean_id; + std::unordered_map m_hashmap; + std::vector m_rev_hashmap; + + public: + StringHasher(); + + int hash(std::string str); + + std::string reverse_hash(int hash); +}; diff --git a/sb_parser/parser b/sb_parser/parser new file mode 100755 index 0000000..33eb252 Binary files /dev/null and b/sb_parser/parser differ diff --git a/sb_parser/parser.cpp b/sb_parser/parser.cpp new file mode 100644 index 0000000..3a0de3f --- /dev/null +++ b/sb_parser/parser.cpp @@ -0,0 +1,220 @@ +#include +#include +#include +#include +#include +#include + +#include "block.hpp" +#include "hasher.hpp" + +namespace fs = std::filesystem; + +typedef enum { STATE_IDLE, STATE_READING_NAME, STATE_READING_ATTR } state_t; + +Block *parse_sb_file(std::ifstream &stream, StringHasher &hasher) +{ + Block *root = new Block(hasher); + root->set_name("root"); + + std::vector block_stack; + block_stack.push_back(root); + + state_t state = STATE_IDLE; + std::string curr_token = ""; + + while (!stream.eof()) { + char c = stream.get(); + + // brackets mean changing current block + if (c == '(' || c == ')') { + if (!curr_token.empty()) { + if (state == STATE_READING_NAME) { + block_stack.back()->set_name(curr_token); + state = STATE_READING_ATTR; + } + else if (state == STATE_READING_ATTR) { + block_stack.back()->add_attr(curr_token); + } + + curr_token.clear(); + } + + state = STATE_READING_NAME; + if (c == '(') { + Block *new_block = new Block(hasher); + block_stack.push_back(new_block); + } + else { + Block *current_block_ptr = block_stack.back(); + block_stack.pop_back(); + + if (!block_stack.empty()) { + Block *prev_block_ptr = block_stack.back(); + prev_block_ptr->add_child(current_block_ptr); + } + } + + continue; + } + + // space means token end + if (c == ' ' || c == '\n' || c == '\t') { + if (curr_token.empty()) { + continue; + } + + if (state == STATE_READING_NAME) { + block_stack.back()->set_name(curr_token); + state = STATE_READING_ATTR; + } + else if (state == STATE_READING_ATTR) { + block_stack.back()->add_attr(curr_token); + } + + curr_token.clear(); + continue; + } + + curr_token += c; + } + + return root; +} + +void collect_files(const std::string &dir, std::vector &sb_files, + std::vector &other_files) +{ + for (auto &path : fs::recursive_directory_iterator(dir)) { + if (!path.is_regular_file()) { + continue; + } + + if (path.path().extension() == ".sb") { + sb_files.push_back(fs::relative(path.path(), dir)); + } + else { + other_files.push_back(fs::relative(path.path(), dir)); + } + } + + std::sort(sb_files.begin(), sb_files.end()); + std::sort(other_files.begin(), other_files.end()); +} + +bool structure_check(std::vector sb_files[2], + std::vector other_files[2]) +{ + if (sb_files[0].size() != sb_files[1].size() || + other_files[0].size() != other_files[1].size()) { + return false; + } + + for (int i = 0; i < (int)(sb_files[0].size()); ++i) { + if (sb_files[0][i] != sb_files[1][i]) { + return false; + } + } + + for (int i = 0; i < (int)(other_files[0].size()); ++i) { + if (other_files[0][i] != other_files[1][i]) { + return false; + } + } + + return true; +} + +bool files_equal(const fs::path &file1, const fs::path &file2) +{ + std::ifstream s1(file1); + std::ifstream s2(file2); + + while (!s1.eof()) { + if (s2.eof()) { + return false; + } + + char c1, c2; + s1 >> c1; + s2 >> c2; + + if (c1 != c2) { + return false; + } + } + + return s2.eof(); +} + +bool sb_files_equal(const fs::path &file1, const fs::path &file2, + StringHasher &hasher) +{ + std::ifstream s1(file1); + std::ifstream s2(file2); + + Block *root1 = parse_sb_file(s1, hasher); + Block *root2 = parse_sb_file(s2, hasher); + + return root1->compare_to(root2) == 0; +} + +int main(int argc, char **argv) +{ + if (argc < 3) { + std::cerr << "Usage: " << argv[0] << " file1.sb file2.sb" << std::endl; + return 2; + } + + const std::string dir1 = std::string(argv[1]); + if (!fs::exists(dir1) || !fs::is_directory(dir1)) { + std::cerr << "Invalid first directory: '" << dir1 << "' :(\n"; + return 2; + } + + const std::string dir2 = std::string(argv[2]); + if (!fs::exists(dir2) || !fs::is_directory(dir2)) { + std::cerr << "Invalid first directory: '" << dir2 << "' :(\n"; + return 2; + } + + std::vector sb_files[2]; + std::vector other_files[2]; + + collect_files(dir1, sb_files[0], other_files[0]); + collect_files(dir1, sb_files[1], other_files[1]); + + //* check filenames and structure + if (!structure_check(sb_files, other_files)) { + std::cerr << "Structure or filename mismatch :(\n"; + return 1; + } + + //* check non-sb files first + for (int i = 0; i < (int)(other_files[0].size()); ++i) { + fs::path file1 = fs::path(dir1) / other_files[0][i]; + fs::path file2 = fs::path(dir2) / other_files[1][i]; + + if (!files_equal(file1, file2)) { + std::cerr << "Non-sb files differ: '" << other_files[0][i] + << "' :(\n"; + return 1; + } + } + + //* check sb files + StringHasher main_hasher; + + for (int i = 0; i < (int)(sb_files[0].size()); ++i) { + fs::path file1 = fs::path(dir1) / sb_files[0][i]; + fs::path file2 = fs::path(dir2) / sb_files[1][i]; + + if (!sb_files_equal(file1, file2, main_hasher)) { + std::cerr << "Sb files differ: " << sb_files[0][i] << " :(\n"; + return 1; + } + } + + //* return success if all checks pass + return 0; +} diff --git a/sb_parser/string_utils.cpp b/sb_parser/string_utils.cpp new file mode 100644 index 0000000..cf6e5cd --- /dev/null +++ b/sb_parser/string_utils.cpp @@ -0,0 +1,16 @@ +#include "string_utils.hpp" + +std::string quote_string(const std::string &a) +{ + std::string ans = "\""; + + for (char c : a) { + if (c == '"') { + ans += '\\'; + } + + ans += c; + } + + return ans + '"'; +} diff --git a/sb_parser/string_utils.hpp b/sb_parser/string_utils.hpp new file mode 100644 index 0000000..823a6b7 --- /dev/null +++ b/sb_parser/string_utils.hpp @@ -0,0 +1,5 @@ +#pragma once + +#include + +std::string quote_string(const std::string &a); diff --git a/tests/build_logs/.dummy b/tests/build_logs/.dummy new file mode 100644 index 0000000..e69de29 diff --git a/tests/iPad2__1_8.4.1_12H321/inputs/sandbox.kext b/tests/iPad2__1_8.4.1_12H321/inputs/sandbox.kext new file mode 100644 index 0000000..659ad95 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/inputs/sandbox.kext differ diff --git a/tests/iPad2__1_8.4.1_12H321/inputs/sandboxd b/tests/iPad2__1_8.4.1_12H321/inputs/sandboxd new file mode 100755 index 0000000..487063c Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/inputs/sandboxd differ diff --git a/tests/iPad2__1_8.4.1_12H321/logs/.dummy b/tests/iPad2__1_8.4.1_12H321/logs/.dummy new file mode 100644 index 0000000..e69de29 diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb new file mode 100644 index 0000000..379c335 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb @@ -0,0 +1,1102 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Media/Purchases") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.reminders.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-journal") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad.LocationPermissions") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iTunesStore/URLCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdLib.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdSheetPhone.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.adtracking.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad.adlibd") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (subpath "/private/var/mobile/Library/SMS") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdSheetPad.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-wal") + (subpath "/private/var/mobile/Library/Caches/com.apple.AdSheetPad") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-shm") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.AdSheetPhone") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Cookies") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (subpath "/private/var/mobile/Library/Fonts") + (subpath "/Library/Dictionaries") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/.+$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPhone/(?|.+)$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState/") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/private/var/mobile/Media/Purchases") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPhone[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPad-.+[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPhone-.*[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone$") + (subpath "/Library/Ringtones") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))))) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$")))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow file-read-metadata + (literal "/private/var/run/printd") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State") + (literal "/private/var/mobile/Library/Caches/Snapshots") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Media") + (literal "/private/var/run/syslog") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage") + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/mobile/Library/PPTDevice") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (literal "/private/var/mobile") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage")))) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-journal") + (subpath "/private/var/mobile/Media/Purchases") + (regex #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad.LocationPermissions") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-wal") + (subpath "/private/var/mobile/Library/Caches/com.apple.iTunesStore/URLCache") + (subpath "/private/var/mobile/Library/Caches/com.apple.AdSheetPad") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb-shm") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad") + (subpath "/private/var/mobile/Library/Caches/com.apple.AdSheetPhone") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (regex #"^/private/var/mobile/Library/Preferences/[.]GlobalPreferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdLib[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPhone[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]reminders[.]plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iad.adlibd") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (subpath "/private/var/mobile/Library/WebClips") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdSheetPhone[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState/") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/tmp/MediaCache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/.+$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]AdSheetPhone/(?|.+)$") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Cookies") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Cookies")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Cookies"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad.savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone.savedState")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage"))))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/Cookies/com.apple.iAd.cookiedb") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelSharedUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.networkd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.ait.client") + (global-name "com.apple.mobilemail.messageuiservices") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.iTunesStore.daemon") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.librariand") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.GSSCred") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name-regex #"^com[.]apple[.]iad[.]") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.tccd") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.system.logger") + (global-name "com.apple.calaccessd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.mobile.deleted") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.webfilterd") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.lsd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.geod") + (global-name "com.apple.bird.token") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobilemail") + (global-name "com.apple.bird") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.imagent.embedded.auth") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.imagent.Embedded.Launched") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.springboard.services") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.eventpump") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.companion.camera") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.dataaccess.dataaccessd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.passd.in-app-payment") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.aggregated") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.dataaccess.dataaccessd.active") + (global-name "com.apple.coremedia.cameraviewfinder") + (global-name "com.apple.fig.movie") + (global-name "com.apple.marco") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.webinspector") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cache_delete") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.chatkit.clientcomposeserver.xpc") + (global-name "com.apple.passd.library") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.securityd") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.coremedia.remaker") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "ScripterServer") + (global-name "com.apple.frontboard.systemappservices") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.FileProvider") + (global-name "com.apple.sharingd") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.TextInput") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/printd") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebUI") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.da") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.mt") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.reminders") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.AdSheetPad") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AdSheetPhone") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.AdSheetPad") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.reminders") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AdSheetPhone") + (preference-domain "com.apple.mobileipod")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AdSheet.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb new file mode 100644 index 0000000..874e526 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb @@ -0,0 +1,86 @@ +(version 1) +(allow default) +(deny file* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-chroot + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-ioctl + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-issue-extension + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-mount) +(deny file-read* + (require-all + (require-not (subpath "/usr/share")) + (require-not (subpath "/usr/lib")) + (require-not (subpath "/System/Library")) + (require-not (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist")) + (require-not (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$")) + (require-not (extension "com.apple.sandbox.executable")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (subpath "/System/Library/Frameworks")) + (require-not (subpath "/System/Library/PrivateFrameworks")) + (require-not (subpath "/private/var/db/timezone")) + (require-any + (literal "/private/var") + (literal "/private/var/root") + (literal "/private/etc/master.passwd") + (require-all + (require-not (literal "/dev/zero")) + (require-not (literal "/dev/dtracehelper")) + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/aes_0")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo")) + (require-not (subpath "/private/var/mobile")) + (require-not (subpath "/private/var/tmp")) + (require-not (literal "/dev/null")) + (require-any + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)))))) +(deny file-unmount) +(deny file-write* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/") + (require-all + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-any + (literal "/private/var") + (literal "/private/var/root") + (literal "/private/etc/master.passwd") + (require-all + (require-not (subpath "/private/var/tmp")) + (require-not (subpath "/private/var/mobile")))))) +(deny file-write-create + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-data + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/") + (require-all + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any + (literal "/dev/urandom") + (literal "/dev/random")))) +(deny file-write-flags + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-mode + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-unlink + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny job-creation) +(deny network-inbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-bind + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-outbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) +(deny process-exec-interpreter + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny system-info + (require-all + (require-not (info-type "net.link.addr")) + (require-any + (require-not (debug-mode)) + (info-type "net.link.addr")))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb.xml new file mode 100644 index 0000000..65176aa --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AirTraffic.sb.xml @@ -0,0 +1,23 @@ + + + + + + + + + +]> + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb new file mode 100644 index 0000000..e4e55e5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb @@ -0,0 +1,584 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library/Frameworks") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-any + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (subpath "/private/var/mobile/Media/iTunes_Control/Artwork") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/dev/urandom") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/dev/aes_0") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow file-read-data + (regex #"^/private/var/ea/ea[.0-9]+$")) +(allow file-read-metadata + (literal "/private/var/run/printd") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library") + (literal "/private/var/mobile") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/PPTDevice") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Meda/DCIM") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/ea/ea[.0-9]+$") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-sem) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network* + (require-all + (require-not (literal "/private/var/tmp/ubiquity.socket")) + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")))) +(allow network-outbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-not (remote tcp "localhost:62078")) + (require-any + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (control-name "com.apple.netsrc") + (literal "/private/var/run/mDNSResponder")))) +(allow user-preference-read + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.CoreMotion") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.da") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb.xml new file mode 100644 index 0000000..f29386d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/AppleDiags.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb new file mode 100644 index 0000000..5af47dc --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb @@ -0,0 +1,587 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read")))))) +(allow file-read* + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (subpath "/System/Library/Frameworks") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-all + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-any + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Media/iTunes_Control/Artwork") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/dev/ptmx") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/dev/null") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-data + (regex #"^/private/var/ea/ea[.0-9]+$")) +(allow file-read-metadata + (literal "/private/var/run/printd") + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Mobile Documents") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write")))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/ea/ea[.0-9]+$") + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-sem) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network* + (require-all + (require-not (literal "/private/var/tmp/ubiquity.socket")) + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")))) +(allow network-outbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-not (remote tcp "localhost:62078")) + (require-any + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (control-name "com.apple.netsrc") + (literal "/private/var/run/mDNSResponder")))) +(allow user-preference-read + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.TelephonyUtilities") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.da") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain ".GlobalPreferences") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mediaaccessibility.public") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb.xml new file mode 100644 index 0000000..7555962 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Aquarium.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb new file mode 100644 index 0000000..03a2314 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb @@ -0,0 +1,431 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/uart.log") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library") + (subpath "/private/var/wireless/Library/Logs/awd") + (literal "/dev/urandom") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (subpath "/usr/lib") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/uart.log") + (literal "/private/var/wireless/Library/CallHistory") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.BTServer.airplane.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/Library/Application Support/BTServer") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileBluetooth.ledevices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (subpath "/private/var/mobile/Library/MobileBluetooth") + (literal "/private/var/mobile/Library/Preferences/com.apple.BTServer.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileBluetooth.devices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileBluetooth.services.plist") + (subpath "/usr/share") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileBluetooth.debug.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (subpath "/private/var/mobile/Library/Logs/Bluetooth") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/"))) +(allow file-read-data + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (subpath "/System") + (literal "/dev/btwake") + (literal "/usr/sbin") + (literal "/usr/sbin/BTServer")) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var") + (literal "/private/var/wireless") + (literal "/usr/sbin") + (literal "/private/var/run/syslog") + (literal "/private/var/wireless/Library") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/Library/Preferences") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (literal "/usr/sbin/BTServer") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") + (literal "/Library/Application Support/BTServer") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") + (literal "/private/var/mobile/Library/Logs/CrashReporter/hci") + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath "/private/var/mobile/Library/MobileBluetooth") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]BTServer[.]airplane[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]BTServer[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileBluetooth[.]devices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileBluetooth[.]ledevices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileBluetooth[.]services[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/Bluetooth") + (literal "/private/var/wireless/Library/CallHistory") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (require-all + (vnode-type DIRECTORY) + (literal "/Library/Application Support/BTServer")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/wireless/Library/CallHistory"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (literal "/dev/uart.log") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOUserEthernetResourceUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "com.apple.BTServer.magnet.shm") + (ipc-posix-name "shm_notif.tacl.R") + (ipc-posix-name "shm_pcm_audio_sco_read") + (ipc-posix-name "shm_notif.tacl.W") + (ipc-posix-name "shm_pcm_audio_sco_write") + (ipc-posix-name "shm_notif.tsco.R") + (ipc-posix-name-regex #"^..:..:..:..:..:..-tacl$") + (ipc-posix-name "shm_notif.tsco.W") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.system.logger") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.BTServer.avrcp") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.BTAudioHALPlugin.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.BTServer.pbap") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.BTServer.map") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.aggregated") + (global-name "com.apple.securityd") + (global-name "com.apple.marco") + (global-name "com.apple.BlueTool") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.notification_center") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.MobileBluetooth.ledevices") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.BTServer") + (preference-domain "com.apple.BTServer.airplane") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.MobileBluetooth.devices") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.MobileBluetooth.debug") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.ids") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileBluetooth.services") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.MobileBluetooth.services") + (preference-domain "com.apple.BTServer.airplane") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.MobileBluetooth.devices") + (preference-domain "com.apple.MobileBluetooth.ledevices") + (preference-domain "com.apple.BTServer") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BTServer.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb new file mode 100644 index 0000000..bc823b0 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb @@ -0,0 +1,267 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/urandom") + (subpath "/System/Library") + (subpath "/usr/lib") + (literal "/usr/sbin") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/etc/bluetool") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-data + (literal "/dev/btwake") + (literal "/dev/btreset")) +(allow file-read-metadata + (literal "/private/var/mobile") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleBasebandUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.networkd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.accountsd.accountmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cookied") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/BlueTool.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb new file mode 100644 index 0000000..ef0282c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb @@ -0,0 +1,241 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/db/timezone") + (literal "/dev/null") + (literal "/dev/ptmx") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/lib") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cookied") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.tccd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.networkd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CFNetworkAgent.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb new file mode 100644 index 0000000..2cd10e1 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb @@ -0,0 +1,239 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/usr/bin/codesign_allocate") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/Frameworks/OpenGLES.framework") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name-regex #"^com[.]apple[.]cvmsCompAgent") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled.public") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/usr/bin/codesign_allocate") + (subpath "/System/Library/Frameworks/OpenGLES.framework")))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CVMServer.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb new file mode 100644 index 0000000..3694c1f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb @@ -0,0 +1,293 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/mux.spi-baseband") + (literal "/dev/uart.log") + (regex #"^/dev/bbcdc[.]" #"^/dev/dlci[.]spi-baseband[.]") + (subpath "/private/var/wireless") + (literal "/dev/cu.debug") + (literal "/dev/uart.debug.log") + (literal "/dev/uart.debug") + (literal "/dev/mux.log") + (literal "/dev/dtracehelper") + (literal "/dev/uart.umts")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath "/private/var/wireless/Library/Caches/CommCenter") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath "/private/var/wireless/Library/Caches/CommCenterClassic") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (regex #"^/private/var/tmp/CSI[.]scratch") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/dev/uart.umts") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/mux.spi-baseband") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.cellulardataplan.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter") + (literal "/private/var/mobile/Library/Preferences/com.apple.videoconference_override.plist") + (literal "/dev/ptmx") + (literal "/dev/mux.log") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (literal "/dev/null") + (subpath "/System/Library/Frameworks") + (literal "/dev/uart.debug.log") + (literal "/private/var/mobile/Library/Preferences/com.apple.tethering_override.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/preferences/AeneasCustomFlags.plist") + (subpath "/private/var/logs/WirelessLibraryLogs") + (literal "/private/var/tmp/csilock") + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$") + (literal "/dev/uart.log") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.operator.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.commcenter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist") + (literal "/dev/cu.debug") + (regex #"^/dev/bbcdc[.]" #"^/dev/dlci[.]spi-baseband[.]") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.iqagent.plist") + (literal "/dev/random") + (literal "/dev/uart.debug") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (subpath "/usr/lib") + (literal "/dev/urandom") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/SyncedPreferences/com.apple.coretelephony.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/dev") + (subpath "/private/var/mobile/Library/LASD") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (require-not (subpath "/private/var/mobile")) + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/mux.spi-baseband") + (literal "/dev/uart.umts") + (literal "/private/var/CommCenter/spool/loading") + (subpath "/private/var/tmp") + (literal "/dev/uart.log") + (literal "/private/var/logs/log-bb-live-stats.txt") + (literal "/private/var/preferences/AeneasCustomFlags.plist") + (subpath "/private/var/wireless") + (literal "/dev/cu.debug") + (regex #"^/private/var/logs/CrashReporter/Baseband/log-bb-$" #"^/private/var/logs/CrashReporter/Baseband/log-bb-.+$" #"^/private/var/logs/CoreTelephonyTrace$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-.+$" #"^/private/var/tmp/CSI[.]scratch" #"^/private/var/preferences/csidata$" #"^/private/var/preferences/csidata[.]tmp$" #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist$" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist-lock$" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist-new$" #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/dev/bbcdc[.]" #"^/dev/dlci[.]spi-baseband[.]") + (subpath "/private/var/logs/WirelessLibraryLogs") + (literal "/private/var/tmp/csilock") + (literal "/dev/uart.debug.log") + (literal "/dev/uart.debug") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist-lock") + (literal "/dev/mux.log") + (subpath "/private/var/mobile/Library/LASD") + (literal "/private/var/logs/CoreTelephonyTraceScratch") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.commcenter.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-owner + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/private/var/mobile/Library/Preferences/com.apple.commcenter.plist"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (global-name-regex #"^com[.]apple[.]CoreTelephony[.]LogChannel[.]$" #"^com[.]apple[.]CoreTelephony[.]LogChannel[.][-0-9A-F]+$") + (global-name "com.apple.CommCenter.lasd")) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local ip "*:*") + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.videoconference_override") + (preference-domain "com.apple.commcenter") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.tethering_override") + (preference-domain "com.apple.cellulardataplan") + (preference-domain "com.apple.iqagent") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.operator") + (preference-domain "com.apple.MobileSMS") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.locationd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb.xml new file mode 100644 index 0000000..5831a8c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/CommCenter.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb new file mode 100644 index 0000000..e6e7c18 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb @@ -0,0 +1,585 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Photos") + (subpath "/private/var/mobile/Media/Debug"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/WebClips") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Photos") + (subpath "/private/var/mobile/Media/Debug"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (subpath "/private/var/mobile/Media/Debug") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/private/var/mobile/Media/com.apple.itdbprep.postprocess.lock") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Fonts") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataActivation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]DataActivation-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation$") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/lib") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilecal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/mobile/Media/Purchases") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/AppleInternal/Library/Safari") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (subpath "/Developer") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (subpath "/Applications/DataActivation.app") + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (regex #"^/private/var/mobile/Library/Preferences/[.]dat") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/System/Library") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath "/private/var/mobile/Library/Caches/Safari") + (subpath "/private/var/tmp") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Library/Safari") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilesafari.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtube.dp.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/Applications/MobileSafari.app") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation.savedState/") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-not (literal "/private/var/mobile/Library/Preferences/com.apple.accountsettings.plist")) + (require-not (literal "/private/var/mobile/Library/Preferences/com.apple.OTASyncAgent.plist")) + (require-not (literal "/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (literal "/dev/null") + (literal "/dev/aes_0") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (literal "/dev/urandom") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation$")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.revisiond.staging"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.revisiond.revision"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/mobile/Library/Caches/Safari") + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]webapp$" #"^/private/var/mobile/Library/Preferences/[.]dat" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilesafari[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtube[.]dp[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (subpath "/private/var/mobile/Library/Safari") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/WebClips") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Media/com.apple.itdbprep.postprocess.lock") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (subpath "/private/var/mobile/Media/Photos") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$") + (subpath "/private/var/mobile/Media/Debug") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation.savedState/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]DataActivation$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelContext") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/lockdown.sock")) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.youtube.dp") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.DataActivation") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Preferences") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.mobilecal") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.camera") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.DataActivation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.youtube.dp") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mobilesafari") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/Applications/DataActivation.app/DataActivation") + (literal "/Applications/MobileSafari.app/MobileSafari")))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb.xml new file mode 100644 index 0000000..34fb0cf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/DataActivation.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb new file mode 100644 index 0000000..160e121 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb @@ -0,0 +1,240 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (literal "/dev/random") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (literal "/dev/aes_0") + (subpath "/System/Library/Frameworks") + (subpath "/usr/lib") + (literal "/dev/null") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.securityd") + (global-name "com.apple.aggregated") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/EscrowSecurityAlert.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb new file mode 100644 index 0000000..44c9410 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb @@ -0,0 +1,253 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/dev/urandom") + (literal "/dev/null") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.imdsmsrecordstore.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.MobileSMS") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/Logs/SMSMigrator") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/SMS") + (literal "/dev/ptmx") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.MobileSMS") + (subpath "/private/var/mobile/Library/Logs/SMSMigrator") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]imdsmsrecordstore[.]plist") + (subpath "/private/var/mobile/Library/SMS") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.search.appindexer") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.searchd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.ids") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imdsmsrecordstore")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/IMDPersistenceAgent.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb new file mode 100644 index 0000000..6cb1655 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb @@ -0,0 +1,929 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/urandom")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$")) + (require-all + (subpath "/private/var/mobile/Library/Caches/AppleTV") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Caches/AppleTV")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$"))))) +(allow file-read* + (subpath "/private/var/mobile/Media/Debug") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.Radio") + (subpath "/private/var/logs/CrashReporter") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-AppleTV.log") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]frontrow[.]") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]lowtide") + (subpath "/private/var/mobile/Media/iTunes_Control") + (literal "/private/var/mobile/Library/Preferences/com.apple.mmcs.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (subpath "/private/var/tmp") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsettings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide/.+$") + (literal "/private/var/mobile/Library/Preferences/com.apple.iqagent.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Cookies") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/tmp/AirTunes") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (subpath "/Applications") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Library/Caches/AppleTV") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (subpath "/private/var/mobile/Media/Radio") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.storebookkeeper.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CrashReporter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.LaunchServices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.airplay.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/Developer/Applications") + (literal "/private/var/mobile/Library/Preferences/com.apple.appletvservices.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.apsd.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]lowtide[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]lowtide[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]lowtide-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide$") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (subpath "/private/var/mobile/Library/MediaStream") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/AppleInternal") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/System/Library") + (subpath "/private/var/mobile/Documents/var/nrd") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdLib.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Library/Logs") + (subpath "/private/var/mobile/Library/Logs/Ubiquity") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.soundpref.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-wal") + (subpath "/private/var/MobileSoftwareUpdate") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.celestial.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/private/var/mobile/Library/Application Support/Front Row") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences-sounds.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (subpath "/private/var/mobile/Updates") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.datetime.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.revisiond.staging"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide$")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.revisiond.revision"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/tmp/MediaControlServer.log") + (literal "/private/var/mobile/Library/Logs") + (subpath "/private/var/mobile/Library/MediaStream") + (subpath "/private/var/mobile/Library/Logs/Ubiquity") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Preferences/com.apple.apsd.launchd") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (subpath "/private/var/mobile/Library/Caches/AppleTV") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mmcs[.]plist" #"^/private/var/mobile/Library/Logs/awd/awd-AppleTV.log") + (regex #"^/private/var/mobile/Library/Preferences/[.]GlobalPreferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AdLib[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]CrashReporter[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]accountsettings[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]airplay[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]aggregated[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]appletvservices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]celestial[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]coremedia[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]demo-settings[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iqagent[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]preferences-sounds[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]preferences[.]datetime[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]soundpref[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]storebookkeeper[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]voiceservices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist") + (literal "/private/var/mobile/Library/Application Support") + (subpath "/private/var/mobile/Media/iTunes_Control") + (subpath "/private/var/mobile/Library/Caches/com.apple.Radio") + (subpath "/private/var/MobileSoftwareUpdate") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp/AirTunes") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath "/private/var/mobile/Library/Application Support/Front Row") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-journal") + (literal "/Library/Application Support/Front Row") + (literal "/private/var/db/timezone/localtime") + (subpath "/private/var/mobile/Documents/var/nrd") + (subpath "/private/var/mobile/Media/Radio") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]frontrow[.]") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileAsset[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.iLifeSlideshow") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb-shm") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]lowtide[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide.savedState/") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]lowtide") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]lowtide/.+$") + (subpath "/private/var/mobile/Media/Debug") + (literal "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Cookies")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]lowtide$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (literal "/private/var/mobile/Documents/var") + (literal "/private/var/mobile/Documents") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Logs/ADDataStore.sqlitedb") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-flags + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/private/var/mobile/Media"))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Updates") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAVServiceUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleNANDFTLUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IODPAudioInterfaceUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAVDeviceUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAVControllerUserClient") + (iokit-user-client-class "IODPServiceUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IODPControllerUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOAVVideoInterfaceUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "ASPUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IODPDeviceUserClient") + (iokit-user-client-class "IOAVAudioInterfaceUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IODPDisplayInterfaceUserClient")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.sharingd") + (global-name "com.apple.securityd") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.fairplayd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.networkd") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.backboard.system-app-server") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.revisiond") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.FileProvider") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.absinthed") + (global-name "com.apple.librariand") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coremedia.cpe") + (global-name "com.apple.atvitunescloudd.xpc") + (global-name "com.apple.backboard.applicationdatastore.service") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.uikit.GestureServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.cookied") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.springboard.services") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.adid") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.frontrow.tracerouteix") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.GSSCred") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated.addaily") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.frontboard.workspace") + (global-name "ScripterServer") + (global-name "UIASTNotificationCenter") + (global-name "PurplePPTServer") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (local-name "com.apple.coremedia.customurlhandler") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.apsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.CrashCopy.OTA") + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.wirelessdisplay") + (global-name "com.apple.TextInput") + (global-name "com.apple.symptomsd") + (global-name "com.apple.absd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.backboard.checkin") + (global-name "com.apple.marco") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.webinspector") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.bird.token") + (global-name "com.apple.lsd") + (global-name "com.apple.itunesstored.xpc") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.bird") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.coremedia.formatreader") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.corercd") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.tzlink") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.coremedia.capturesource") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.coremedia.formatreaderloader") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.mobile.softwareupdated") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.backboard.workspaceserverconnection") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.SBUserNotification") + (global-name-regex #"^com[.]apple[.]appletv$" #"^com[.]apple[.]appletv[.]" #"^com[.]apple[.]lowtide$" #"^com[.]apple[.]lowtide[.]") + (global-name "com.apple.airplay.xpc") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.frontboard.watchdogserver") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow mach-task-name) +(allow network-inbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/tmp/hidmonitordsocket") + (remote udp "*:*") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.storebookkeeper") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.soundpref") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.MapKit.internal") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mediaremote") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.accountsettings") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.appletvservices") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.da") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.airplay") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mediaaccessibility.public") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.airplay") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.celestial") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.accountsettings") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.storebookkeeper") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.soundpref") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.appletvservices") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.preferences-sounds")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (subpath "/Applications/AppleTV.app"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl) +(allow system-info + (info-type "net.link.addr") + (info-type "hw.uuid")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb.xml new file mode 100644 index 0000000..a6fa739 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Lowtide.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb new file mode 100644 index 0000000..2f92f5d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb @@ -0,0 +1,231 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/etc/master.passwd") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/null") + (subpath "/System/Library") + (subpath "/System/Library/Extensions") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/logs/Metal") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/logs/Metal") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MTLCompilerService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb new file mode 100644 index 0000000..b94afc2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb @@ -0,0 +1,883 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mail.composition.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath "/AppleInternal/Library/Frameworks") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MailCompositionService[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MailCompositionService[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MailCompositionService-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/Library/Ringtones") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/mobile/Media/Purchases") + (subpath "/private/var/mobile/Library/WebKit") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (subpath "/private/var/mobile/Library/Cookies") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))))) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.revisiond.revision"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.revisiond.staging"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mail[.]composition[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath "/private/var/mobile/Media/Safari") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MailCompositionService[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService.savedState/") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (subpath "/private/var/mobile/Library/WebClips") + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService.savedState")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice2")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.webinspector") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.uikit.GestureServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.securityd") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.springboard.services") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.symptomsd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.bird.token") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.bird") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.bulletinboard.utilitiesconnection") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.revisiond") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.GSSCred") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.lsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.marco") + (global-name-regex #"^com[.]apple[.]dataaccess[.]dataaccessd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.webfilterd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.coreduetd") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.springboard") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "ScripterServer") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.coremedia.capturesource") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.librariand") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.TextInput") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.suggestd.suggestionmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.nanoprefsync") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cookied") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.mobilegestalt.xpc") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.sharingd") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.FileProvider") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/printd") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.mobileipod") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.da") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.WebKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AppSupport") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.EmojiPreferences") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MailCompositionService.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb new file mode 100644 index 0000000..eb78f23 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb @@ -0,0 +1,26 @@ +(version 1) +(allow default) +(deny file* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-chroot + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-read* + (subpath "/private/var/run/mobile_image_mounter")) +(deny file-write* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-create + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-unlink + (literal "/private/var") + (literal "/private/var/run") + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/") + (literal "/private")) +(deny job-creation) +(deny network-inbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-bind + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-outbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) +(deny process-exec-interpreter + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb.xml new file mode 100644 index 0000000..c2485d3 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileBackup.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb new file mode 100644 index 0000000..14435e9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb @@ -0,0 +1,599 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/Calendar$" #"^/private/var/mobile/Library/Logs/Calendar/" #"^/private/var/mobile/Library/Calendar$" #"^/private/var/mobile/Library/Calendar/" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/System/Library") + (subpath "/AppleInternal/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.calendardiagnostics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilecal.timezones.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilecal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobilecal-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal$") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal.savedState/") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Media/Purchases") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal$")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/dev/random") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]calendardiagnostics[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilecal[.]timezones[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Logs/Calendar$" #"^/private/var/mobile/Library/Logs/Calendar/" #"^/private/var/mobile/Library/Calendar$" #"^/private/var/mobile/Library/Calendar/") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal.savedState/") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobilecal$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelSubmitter2")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobilecal.timezones") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.da") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.accountsd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.calendardiagnostics") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.keyboard") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.calendardiagnostics") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mobilecal.timezones") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb.xml new file mode 100644 index 0000000..34fb0cf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileCal.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb new file mode 100644 index 0000000..bca6b5a --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb @@ -0,0 +1,686 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mms_override.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.internal.Voltaire.plist") + (subpath "/AppleInternal") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]Maps") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapsSupport.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.skyhookwireless.wps.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Maps") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.weather.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.GMM.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Maps.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/Caches/Maps") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps/.+$") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]Maps-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps$") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps.savedState/") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps$")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/dev/urandom") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps$")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-data + (regex #"^/private/var/ea/ea[.0-9]+$")) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]GMM[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]skyhookwireless[.]wps[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]backedup[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]internal[.]Voltaire[.]plist" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]Maps") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/Maps") + (subpath "/private/var/mobile/Library/Maps") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps/$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iTunesStore/ISURLBag/com[.]apple[.]Maps/.+$") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps.savedState/") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Cookies")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]Maps$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore") + (literal "/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (regex #"^/private/var/ea/ea[.0-9]+$") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSubmitter2") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.da") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.skyhookwireless.wps") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mms_override") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.internal.Voltaire") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mediaaccessibility.public") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.homesharing") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Maps") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.UIKit") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.internal.Voltaire") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.skyhookwireless.wps") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Maps") + (preference-domain "com.apple.assistant.backedup") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (socket-domain 39) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb.xml new file mode 100644 index 0000000..34fb0cf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileMaps.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb new file mode 100644 index 0000000..2aa51b5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb @@ -0,0 +1,565 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/System/Library") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (subpath "/private/var/mobile/Media/Debug") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath "/private/var/mobile/Media/PhotoData") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileSMS[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MobileSMS[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MobileSMS-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (subpath "/private/var/mobile/Media/Purchases") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]MobileSMS[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MobileSMS[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (subpath "/private/var/tmp") + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Library/")) + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/PPTDevice") + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Mobile Documents") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Media") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Caches/Snapshots") + (literal "/private/var/mobile/Library") + (literal "/private/var/mobile/Library/Saved Application State") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Media/Debug") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MobileSMS$") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileSMS[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MobileSMS$" #"^/private/var/mobile/Documents/com[.]apple[.]MobileSMS[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MobileSMS[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState/") + (subpath "/private/var/mobile/Media/Photos") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS$")) + (require-all + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileSMS[.]plist") + (subpath "/private/var/mobile/Library/SMS"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MobileSMS$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MobileSMS.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.springboard") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.da") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.avfoundation") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.MobileSMS") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb.xml new file mode 100644 index 0000000..7dd92d4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSMS.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb new file mode 100644 index 0000000..b19c1de --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb @@ -0,0 +1,786 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Media/Photos"))) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoStreamsData")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read")))))) +(allow file-read* + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.imessage.bag.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mmcs.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Logs/awd/awdComponent0x19.log") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.airplay.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Library/Preferences/com.apple.compass.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.notbackedup.plist") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist") + (literal "/private/var/mobile/Library/Logs/MobileSlideShow.log") + (literal "/private/var/mobile/Library/Logs/awd/awd-Camera.log") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (subpath "/private/var/mobile/Library/SMS") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes/iTunes Library.itlp") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (subpath "/private/var/mobile/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanocamera.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.videouploadplugins.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (subpath "/private/var/mobile/Library/Application Support/iLifePageLayout") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (regex #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap") + (literal "/private/var/mobile/Library/Preferences/com.apple.GMM.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist") + (subpath "/private/var/mobile/Library/Caches/Snapshots/com.apple.camera") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Artwork") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.act.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mms_override.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]")) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (subpath "/private/var/mobile/Library/Dictionaries") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Library/Fonts") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Media/Debug") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]camera[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobileslideshow-.+[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]camera-.*[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera$") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Safari") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/Photos") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow.savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera.savedState/") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Media/DCIM") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/tmp") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/Library/Ringtones") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/random") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$" #"^/private/var/mobile/Library/")) + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")))) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Logs/awd/awd-Camera.log") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (subpath "/private/var/mobile/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest[.]log") + (subpath "/private/var/mobile/Library/Application Support/iLifePageLayout") + (regex #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap") + (subpath "/private/var/mobile/Library/SMS") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (literal "/private/var/mobile/Library/Logs/MobileSlideShow.log") + (subpath "/private/var/mobile/Library/Caches/Snapshots/com.apple.camera") + (literal "/private/var/mobile/Library/Logs/awd/awdComponent0x19.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist")) + (require-any + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]nanocamera[.]plist" #"^/private/var/mobile/Library/Preferences/[.]GlobalPreferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]camera[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]videouploadplugins[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]notbackedup[.]plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/mobile/Media/PhotoData") + (subpath "/private/var/mobile/Media/Debug") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Media/Photos") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]camera[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow.savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera.savedState/") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]camera$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes")))) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Logs/awd") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow.savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mnt") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.nanocamera") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.coreaudio") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.act") + (preference-domain "com.apple.videouploadplugins") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mt") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.MobileSMS") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.youtubeframework.notbackedup") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.PeoplePicker") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.da") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mmcs") + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.nanocamera") + (preference-domain "com.apple.videouploadplugins") + (preference-domain "com.apple.youtubeframework.notbackedup") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.camera")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb.xml new file mode 100644 index 0000000..5831a8c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/MobileSlideShow.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb new file mode 100644 index 0000000..6b85530 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb @@ -0,0 +1,194 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIKit.pboard") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (subpath "/System/Library") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/random") + (subpath "/private/var/tmp") + (literal "/dev/urandom") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIKit.pboard") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/System/Library/Frameworks/UIKit.framework/Support/pasteboardd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb.xml new file mode 100644 index 0000000..6587f2c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/PasteBoard.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb new file mode 100644 index 0000000..c071291 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb @@ -0,0 +1,519 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/db/timezone") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/usr/share") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/tmp") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-any + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/dev/aes_0") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.stocks.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stocks[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]stocks[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]stocks-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks$") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/dev/zero") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/mobile/Library/Fonts") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]stocks[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]stocks[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Stocks$" #"^/private/var/mobile/Library/Stocks/") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Library/")) + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/PPTDevice") + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Saved Application State") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/mobile/Library") + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Caches/Snapshots") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stocks[.]plist" #"^/private/var/mobile/Library/Stocks$" #"^/private/var/mobile/Library/Stocks/") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stocks[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]stocks$" #"^/private/var/mobile/Documents/com[.]apple[.]stocks[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]stocks[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState/") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]stocks$") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]stocks$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]stocks.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.stocks") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.da") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.preferences.sounds") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.itunesstored") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.EmojiPreferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.stocks") + (preference-domain "com.apple.Preferences")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb.xml new file mode 100644 index 0000000..7dd92d4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/Stocks.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb new file mode 100644 index 0000000..35c975c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb @@ -0,0 +1,236 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.StreamingUnzipService.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (literal "/dev/urandom") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/etc/master.passwd") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (subpath "/private/var/tmp") + (extension "com.apple.StreamingUnzipService") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/random") + (literal "/dev/null") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.StreamingUnzipService") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]StreamingUnzipService[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.duetknowledged.activity") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.StreamingUnzipService") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.StreamingUnzipService")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/StreamingUnzipService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb new file mode 100644 index 0000000..2ac53ef --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb @@ -0,0 +1,839 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (subpath "/System/Library") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobilemail[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]accountsettings[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]OTASyncAgent[.]plist$")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebSheet.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/WebKit/Databases") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebSheet[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]WebSheet[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]WebSheet-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet$") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/Library/Ringtones") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet.savedState/") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.camera.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet$")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet$")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos"))))))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (require-all + (require-not (literal "/private/var/mobile/Library/Mail/AutoFetchEnabled")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]accountsettings[.]plist$")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebSheet[.]plist") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist") + (subpath "/private/var/mobile/Library/WebKit") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/mobile/Library/WebClips") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebSheet[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet.savedState/") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]WebSheet$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")))))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice2")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.mobilesafari-settings") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.symptomsd") + (global-name "com.apple.bird.token") + (global-name "com.apple.bird") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.itunescloudd.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.SBUserNotification") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.eventpump") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.GSSCred") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.tccd") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.securityd") + (global-name "com.apple.mobilemail.messageuiservices") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.revisiond") + (global-name "com.apple.webfilterd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.TextInput.shortcuts") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "ScripterServer") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd") + (global-name "com.apple.fig.movie") + (global-name "com.apple.aggregated") + (global-name "com.apple.marco") + (global-name "com.apple.librariand") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.TextInput") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.mobilegestalt.xpc") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.webinspector") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.mobilemail") + (global-name "com.apple.SystemConfiguration.configd") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cookied") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.sharingd") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.FileProvider") + (global-name "com.apple.certui.relay") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.springboard.services") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog") + (literal "/private/var/run/printd")) +(allow user-preference-read + (preference-domain "com.apple.youtubeframework") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.da") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.WebUI") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/Applications/WebSheet.app/WebSheet"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/WebSheet.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb new file mode 100644 index 0000000..2101ef8 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb @@ -0,0 +1,204 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iapd.plist") + (literal "/dev/aes_0") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/random") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols") + (require-not (subpath "/private/var/mobile")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iapd[.]plist") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.iapd") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iapd")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/usr/sbin/accessoryd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb.xml new file mode 100644 index 0000000..7dd92d4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/accessoryd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb new file mode 100644 index 0000000..b07a1a2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb @@ -0,0 +1,280 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.afc.root") + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$"))))) +(allow file-read* + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/db/timezone") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/urandom") + (literal "/AFCDEBUG") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.afc.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.afc.root") + (literal "/usr/libexec/afcd") + (literal "/usr/libexec") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$") + (literal "/dev/null") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))))) +(allow file-read-metadata + (literal "/private") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/Library/Preferences") + (literal "/Library/Preferences/SystemConfiguration") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$") + (extension "com.apple.afc.root") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]afc$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.securityd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.xpchelper") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.afc") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/afcd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb new file mode 100644 index 0000000..fbdc31f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb @@ -0,0 +1,257 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/aes_0") + (regex #"^/System/Library/CoreServices/SystemVersion$" #"^/System/Library/CoreServices/SystemVersion.+$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$") + (literal "/dev/urandom") + (literal "/Library/Managed Preferences/mobile") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/Keychains") + (extension "com.apple.sandbox.executable") + (literal "/Library/Keychains") + (subpath "/private/var/mobile/Library/Logs") + (subpath "/private/var/db/timezone") + (literal "/Library/Preferences") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (subpath "/usr/lib") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/preferences") + (subpath "/private/var/mobile/Library/Managed Preferences") + (literal "/dev/ptmx") + (subpath "/System/Library/Frameworks") + (subpath "/usr") + (regex #"^/private/var/mobile/Library/Caches/com.apple.persistentconnection") + (subpath "/private/etc") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ApplePushService") + (subpath "/private/var/tmp") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd$")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Library/Logs") + (regex #"^/private/var/mobile/Library/Caches/com.apple.persistentconnection" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$") + (subpath "/private/var/mobile/Library/ApplePushService") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]apsd$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"." #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/System/Library/PrivateFrameworks/ApplePushService.framework/apsd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb.xml new file mode 100644 index 0000000..5831a8c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/apsd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb new file mode 100644 index 0000000..29a0edf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb @@ -0,0 +1,14 @@ +(version 1) +(deny default) +(allow iokit-get-properties) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self)) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb.xml new file mode 100644 index 0000000..7baaeea --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cloudphotod.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb new file mode 100644 index 0000000..1d58a9a --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb @@ -0,0 +1,305 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (literal "/dev/urandom") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/null") + (literal "/dev/random") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.AssetCacheLocatorService.plist") + (literal "/dev/aes_0") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols") + (literal "/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.tccd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.system.logger") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.cookied") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.daemon") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local udp "*:*"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (remote udp "*:53") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics")) +(allow user-preference-read + (preference-domain "com.apple.AssetCacheLocatorService") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb new file mode 100644 index 0000000..99df09c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb @@ -0,0 +1,230 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/dev/urandom") + (literal "/private/var/db/heim-credential-store.archive") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/dev/aes_0") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/db/heim-credential-store.archive") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.GSSCred.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb new file mode 100644 index 0000000..131dcca --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb @@ -0,0 +1,212 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.tccd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb.xml new file mode 100644 index 0000000..ee527ac --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Databases.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb new file mode 100644 index 0000000..d8edef0 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb @@ -0,0 +1,263 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (literal "/dev/ptmx") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/random") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/urandom") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.app-sandbox.read") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.app-sandbox.read") + (regex #"/Info[.]plist$" #".+/Info[.]plist$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (vnode-type SYMLINK)) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.aggregated") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cookied") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.ocspd") + (global-name "com.apple.networkd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb.xml new file mode 100644 index 0000000..ee527ac --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.Networking.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb new file mode 100644 index 0000000..07886b0 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb @@ -0,0 +1,555 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.LaunchServices.plist") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/zero") + (subpath "/System/Library/Frameworks") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/dev/null") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (subpath "/Developer") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-not (vnode-type SYMLINK)) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSubmitter2") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.TextInput.shortcuts") + (local-name "com.apple.cfprefsd.agent") + (global-name "ScripterServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.TextInput") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.FileProvider") + (global-name "com.apple.securityd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.librariand") + (global-name "com.apple.springboard.services") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.tccd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "com.apple.revisiond") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.fig.movie") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.system.logger") + (global-name "com.apple.voiceservices.keepalive") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.GSSCred") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.lsd") + (global-name "com.apple.cookied") + (global-name "com.apple.webinspector") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.bird.token") + (global-name "com.apple.bird") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.marco") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.sharingd") + (global-name "com.apple.itunesstored.xpc") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.da") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mediaaccessibility.public") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.EmojiPreferences") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-audit) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml new file mode 100644 index 0000000..ee527ac --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb new file mode 100644 index 0000000..4f3c3c4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb @@ -0,0 +1,468 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/usr/local/lib") + (subpath "/private/var/tmp") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.token.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-assistantd[.]log" #"^/private/var/mobile/Library/Caches/com[.]apple[.]siri[.]") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voicetrigger.plist") + (subpath "/System/Library") + (subpath "/Library/Audio/Tunings") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (subpath "/private/var/mobile/Library/Assistant") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataMigration.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.avvc.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.weather.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/siri_recordings") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.logging.plist") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/Assistant") + (literal "/private/var/mobile/Library/Preferences/com.apple.AssistantServices.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.siri.backedup.encrypted.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.backedup.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/run/syslog") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/PPTDevice") + (vnode-type SYMLINK) + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]siri[.]") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/Assistant") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-assistantd[.]log") + (subpath "/private/var/mobile/Library/Assistant") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]AssistantServices[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]backedup[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]logging[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]support[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]token[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]siri[.]backedup[.]encrypted[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]voicetrigger[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]weather[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]assistantd$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coreduetd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.assistant_service") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.marco") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.cookied") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.absd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.tccd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.BTLEAudioController.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.absinthed") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.networkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accountsd.accountmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.audio.AudioQueueServer") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.avfoundation.avvc") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mediaremote") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.assistant.token") + (preference-domain "com.apple.AssistantServices") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.siri.backedup.encrypted") + (preference-domain "com.apple.AppSupport") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.weather") + (preference-domain "com.apple.AssistantServices") + (preference-domain "com.apple.assistant.token") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.siri.backedup.encrypted") + (preference-domain "com.apple.assistant.backedup") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (socket-domain 39) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.assistant.assistantd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb new file mode 100644 index 0000000..a998c78 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb @@ -0,0 +1,427 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (extension-class "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Mobile Documents/")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (extension-class "com.apple.librarian.ubiquity-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$")) + (require-all + (vnode-type REGULAR-FILE) + (extension-class "com.apple.clouddocs.version") + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (subpath "/private/var/tmp") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Logs/CloudDocs") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Library/Mobile Documents") + (literal "/dev/random") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]bird" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]bird") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/Caches/CloudKit/com.apple.bird") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Application Support/CloudDocs") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/CloudKit/com.apple.clouddocs") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/private/var/mobile/Library/Mobile Documents[.]") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.bird.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ubd.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.CloudKit.BehaviorOptions.plist") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]bird" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]bird") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (regex #"^/private/var/mobile/Library/Mobile Documents[.]") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]ubd[.]plist") + (subpath "/private/var/mobile/Library/Mobile Documents") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity") + (subpath "/private/var/mobile/Library/Caches/CloudKit/com.apple.bird") + (subpath "/private/var/mobile/Library/Application Support/CloudDocs") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/CloudKit/com.apple.clouddocs") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") + (subpath "/private/var/mobile/Library/Logs/CloudDocs") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]appleaccount[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]bird[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$") + (subpath "/private/var/mobile/Library/Cookies") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]bird$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/CloudKit")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Application Support")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.revisiond") + (global-name "com.apple.networkd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cookied") + (global-name "com.apple.bird.ContainerMetadataExtractor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cloudd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.FSEvents") + (global-name "com.apple.apsd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.logger") + (global-name "com.apple.securityd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ubd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.librariand") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.bird") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 32))) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb.xml new file mode 100644 index 0000000..d118cf1 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.bird.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb new file mode 100644 index 0000000..e140a85 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb @@ -0,0 +1,426 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/dev/ptmx")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (regex #"^/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/var/mobile/Containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/mobile/Containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/preferences/com.apple.networkd.plist") + (mount-relative-regex #"^/[.]TemporaryItems$" #"^/[.]TemporaryItems/" #"^/[.]DocumentRevisions-V100$" #"^/[.]DocumentRevisions-V100/" #"^/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/[.]DocumentRevisions-V100-bad-[0-9]+/") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Logs/Ubiquity") + (regex #"^/private/var/tmp/CKTraffic$" #"^/private/var/tmp/CKTraffic[^/]+$" #"^/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/db/DetachedSignatures") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit" #"^/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+") + (subpath "/private/var/mobile/Library/Keychains") + (regex #"^/var/tmp$" #"^/var/tmp/" #"^/private/var/tmp$" #"^/private/var/tmp/") + (literal "/private/var/mobile/Library/Preferences/com.apple.purplebuddy.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/db/mds/messages/se_SecurityMessages") + (regex #"^/Library/Keychains/System.keychain") + (literal "/dev/urandom") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/zero") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/logs/Ubiquity") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]cloudd") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.nsurlsessiond") + (literal "/private/var/run/diagnosticd/dyld_shared_cache_x86_64") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Logs/awd") + (literal "/Library/Preferences/SystemConfiguration/preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.migration.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/etc/hosts") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/db/mds/system/mdsDirectory.db") + (subpath "/private/var/mobile/Library/Caches/com.apple.cloudd") + (literal "/Library/Preferences/com.apple.security.plist") + (literal "/") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/mobile/Library/Caches/CloudKit") + (literal "/private/var/mobile/Library/Logs/ProtectedCloudStorage.log") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-data + (literal "/dev/aes_0")) +(allow file-read-metadata + (literal "/tmp") + (literal "/var") + (literal "/private/var/mobile") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library") + (literal "/Library") + (literal "/private/var/mobile/Library/Caches") + (literal "/Library/Security/Trust Settings/Admin.plist") + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var") + (literal "/AppleInternal") + (literal "/private") + (regex #"^/var/tmp$" #"^/private/var/tmp$" #"^/var$" #"^/private/var$") + (subpath "/private/var/db/mds") + (vnode-type SYMLINK) + (literal "/Library/Keychains") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/") + (literal "/private/var/tmp") + (literal "/private/etc/localtime") + (literal "/private/var/run/systemkeychaincheck.done") + (subpath "/private/var/db/icu") + (vnode-type DIRECTORY) + (literal "/Library/Logs") + (literal "/private/var/db") + (literal "/etc") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/tmp") + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Caches") + (subpath "/private/var/mobile/Library/Caches/com.apple.cloudd") + (mount-relative-regex #"^/[.]TemporaryItems$" #"^/[.]TemporaryItems/") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit" #"^/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Keychains") + (regex #"^/var/tmp$" #"^/var/tmp/" #"^/private/var/tmp$" #"^/private/var/tmp/") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/com.apple.nsurlsessiond") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/logs/Ubiquity") + (subpath "/private/var/mobile/Library/Logs/awd") + (literal "/") + (subpath "/private/var/mobile/Library/Logs/Ubiquity") + (regex #"^/Library/Keychains/System.keychain" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]purplebuddy[.]plist") + (subpath "/private/var/mobile/Library/Caches/CloudKit") + (literal "/private/var/mobile/Library/Logs/ProtectedCloudStorage.log") + (regex #"^/private/var/tmp/CKTraffic$" #"^/private/var/tmp/CKTraffic[^/]+$" #"^/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (regex #"^/cores/") + (require-not (file-mode #o0000))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write-xattr + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (mount-relative-regex #"^/[.]DocumentRevisions-V100$" #"^/[.]DocumentRevisions-V100/" #"^/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/[.]DocumentRevisions-V100-bad-[0-9]+/"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-read-data + (ipc-posix-name "FNetwork.defaultStorageSession") + (ipc-posix-name "com.apple.AppleDatabaseChanged") + (ipc-posix-name-regex #"^/tmp/com[.]apple[.]csseed[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.datamigrator") + (global-name "com.apple.securityd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.coreservices.quarantine-resolver") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.fairplayd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.windowserver.active") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.xpcd") + (global-name "com.apple.cookied") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.ocspd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.apsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.tccd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.distributed_notifications@Uv3") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.aggregated") + (global-name "com.apple.awdd") + (global-name "com.apple.fairplayd.versioned") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.assertiond.processassertionconnection") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.cloudd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb new file mode 100644 index 0000000..caf7524 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb @@ -0,0 +1,243 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (subpath "/AppleInternal") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (subpath "/Applications") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/usr/share") + (subpath "/System/Library/Frameworks") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Containers/Bundle") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.logger") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobilephone") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb new file mode 100644 index 0000000..cfe23ed --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb @@ -0,0 +1,270 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/Library/Preferences/[.]GlobalPreferences[.]" #"^/Library/Preferences/ByHost/[.]GlobalPreferences[.]" #"^/Library/Preferences/com[.]apple[.]security[.]") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/usr/libexec") + (literal "/dev/aes_0") + (literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") + (subpath "/private/var/db/timezone") + (literal "/Library/Preferences/com.apple.crypto.plist") + (literal "/Library/Managed Preferences") + (literal "/Library/Security/Trust Settings/Admin.plist") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/usr/libexec/discoveryd") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (subpath "/usr/lib") + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.discoveryd.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "wlDNSOffloadUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "mDNSOffloadUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.tccd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.discoveryd_helper") + (global-name "com.apple.aggregated") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.daemon") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.blued") + (global-name "com.apple.securityd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.snhelper") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network* + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.discoveryd") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb.xml new file mode 100644 index 0000000..d8a3680 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.discoveryd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb new file mode 100644 index 0000000..447359d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb @@ -0,0 +1,462 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/usr/lib") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]homed") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/homed") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/urandom") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.homed.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-homed[.]log") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/dev/zero") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/HomeConfiguration") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Logs/awd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library") + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-homed[.]log") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]homed[.]plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/HomeConfiguration") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/homed") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.lsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cookied") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.symptomsd") + (global-name "com.apple.revisiond") + (global-name "com.apple.fig.movie") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.apsd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.FileProvider") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.bird.token") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.librariand") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.securityd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.bird") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.cloudd") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.logger") + (global-name "com.apple.networkd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.SystemConfiguration.configd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.homed") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.homed") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.homed.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb new file mode 100644 index 0000000..6a72965 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/root/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/root/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist" #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (subpath "/usr/libexec") + (literal "/dev/aes_0") + (subpath "/Applications") + (subpath "/System/Library") + (literal "/dev/ptmx") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/root/Library/Cookies") + (subpath "/usr/lib") + (literal "/dev/null") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Containers/Bundle/Application") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/sbin") + (literal "/dev/urandom") + (literal "/private/etc/master.passwd") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/root/Library/Caches") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/root/Library/Cookies") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist" #"^/private/var/preferences/SystemConfiguration/preferences[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist" #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.lsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.networkd") + (global-name "com.apple.cookied") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.tccd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.system.logger") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.assertiond.processassertionconnection") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.nehelper")) +(allow network* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local udp "*:500") + (literal "/private/var/run/racoon.sock") + (local udp "*:4500")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (control-name "com.apple.net.necp_control") + (control-name "com.apple.flow-divert") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.net.ipsec_control") + (control-name "com.apple.net.utun_control") + (control-name "com.apple.network.statistics") + (control-name "com.apple.content-filter")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl* + (sysctl-name-regex #"^net[.]necp[.].+" #"^net[.]inet[.]ipsec[.].+")) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb.xml new file mode 100644 index 0000000..d8a3680 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nehelper.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb new file mode 100644 index 0000000..f974d73 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb @@ -0,0 +1,284 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/etc/ppp") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (literal "/dev/random") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/run/racoon.pid") + (literal "/private/var/mobile/Library/Preferences/com.apple.networkextension.plist") + (literal "/dev/null") + (literal "/dev/ptmx") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/Frameworks") + (literal "/usr/sbin/pppd") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/private/etc/master.passwd") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/usr/libexec") + (literal "/usr/sbin") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist" #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (subpath "/private/var/mobile/Containers/Bundle/VPNPlugin") + (subpath "/private/var/tmp") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/run/racoon") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/urandom") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols") + (literal "/"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist" #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (literal "/private/var/log/ppp.log") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (subpath "/private/var/run/racoon") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.nehelper") + (global-name "com.apple.symptomsd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.networkd") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.neagent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.securityd") + (global-name "com.apple.UNCUserNotification") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.ocspd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network* + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (literal "/private/var/run/vpncontrol.sock") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.networkextension") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/usr/sbin/pppd"))) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (sysctl-name "net.key.natt_keepalive_interval")) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb.xml new file mode 100644 index 0000000..e19a9e9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.nesessionmanager.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb new file mode 100644 index 0000000..17ec6e2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb @@ -0,0 +1,264 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Application Support/Quick Look") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-journal") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-shm") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-wal") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/ptmx") + (subpath "/System/Library") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session") + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Library/Mobile Documents") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-journal") + (literal "/private/var/mobile/Library/Application Support/Quick Look") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-wal") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db-shm") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Application Support/Quick Look")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Application Support/Quick Look/cloudthumbnails.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.revisiond") + (global-name "com.apple.aggregated") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb new file mode 100644 index 0000000..8e50e58 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb @@ -0,0 +1,334 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/rtcreportingd.plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-rtcreportingd[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/Retired/rtcreportingd_.+") + (subpath "/usr/lib") + (literal "/dev/aes_0") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.VideoConference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.rtcreporting.plist") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.timed.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (literal "/usr/libexec/rtcreportingd") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.rtcreporting.upload") + (literal "/usr/libexec") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (literal "/dev/null") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd$")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-data + (literal "/private/var/mobile/Library/Logs/CrashReporter/Retired")) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/Retired") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/Retired")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-rtcreportingd[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/Retired/rtcreportingd_.+" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]rtcreporting[.]plist" #"^/private/var/mobile/Library/Preferences/rtcreportingd[.]plist" #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/Retired"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.rtcreporting.upload") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.aggregated") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.networkd") + (global-name "com.apple.system.logger") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.powerlogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.securityd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.cookied") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.awdd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.commcenter.cupolicy.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nsurlstorage-cache") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local udp "*:*"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "rtcreportingd") + (preference-domain "com.apple.timed") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.rtcreporting") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.rtcreporting") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "rtcreportingd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.rtcreportingd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb new file mode 100644 index 0000000..88082c5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb @@ -0,0 +1,66 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/dev/dtracehelper"))) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/logs/CrashReporter/Sandbox-.+[.]ips") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.cfprefsd.daemon") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc")) +(allow network* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/private/var/tmp/sandbox[.]"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (regex #"^/private/tmp/[.]webdavUDS[.][^/]+$") + (literal "/private/var/run/asl_input")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self) + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb.xml new file mode 100644 index 0000000..9b1bfa2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.sandboxd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb new file mode 100644 index 0000000..0673efa --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb @@ -0,0 +1,230 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (literal "/dev/random") + (subpath "/usr/lib") + (literal "/dev/urandom") + (subpath "/private/var/db/timezone") + (subpath "/var/mobile/Library/Caches") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.tccd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.snhelper")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.snhelper.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb new file mode 100644 index 0000000..1149877 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb @@ -0,0 +1,53 @@ +(version 1) +(deny default) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (extension-class-regex #"^com[.]apple[.]tcc[.]"))) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp/com.apple.tccd") + (subpath "/private/var/mobile/Library/TCC")))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.backboard.systemservices") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.system.logger") + (global-name "com.apple.companionappd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.springboard.services") + (global-name "com.apple.librariand") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.pluginkit.pkd")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (regex #"^/private/tmp/[.]webdavUDS[.][^/]+$")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb.xml new file mode 100644 index 0000000..2b51e53 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tccd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb new file mode 100644 index 0000000..fe00f08 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb @@ -0,0 +1,233 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath "/usr/lib") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/urandom") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/db/timezone/localtime") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/db/timezone/localtime") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.tzlinkd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb new file mode 100644 index 0000000..0cfc664 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb @@ -0,0 +1,363 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/mobile/Library/processed-Mobile Documents[.]delete" #"^/private/var/mobile/Library/Mobile Documents" #"^/private/var/mobile/Library/Collections" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$") + (literal "/private/var/mobile/Library/Preferences/com.apple.bird.plist") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/random") + (subpath "/private/var/tmp") + (literal "/dev/urandom") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.mmcs.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]ubd") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.ubd.plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-ubd[.]log") + (literal "/private/var/mobile/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Application Support") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Application Support") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-ubd[.]log" #"^/private/var/mobile/Library/processed-Mobile Documents[.]delete" #"^/private/var/mobile/Library/Mobile Documents" #"^/private/var/mobile/Library/Collections" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]ubd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mmcs[.]plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]ubd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.logger") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.securityd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.symptomsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.absinthed") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.absd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.apsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.bird") + (global-name "com.apple.tccd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/lockdown.sock")) +(allow user-preference-read + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.persistentconnection") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.bird") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ubd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Support/ubd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-fsctl + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 24))) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb.xml new file mode 100644 index 0000000..f2db312 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.ubd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb new file mode 100644 index 0000000..0c18d5b --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb @@ -0,0 +1,239 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/root") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (literal "/private/var/db/.debug_xpcd") + (subpath "/usr") + (subpath "/AppleInternal") + (subpath "/Developer") + (subpath "/Library/Audio/Plug-Ins") + (subpath "/System") + (subpath "/System/Library") + (literal "/dev/aes_0") + (subpath "/private/var/mobile/Containers/Bundle") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/Assets") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/urandom") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile") + (literal "/dev/ptmx") + (subpath "/Applications") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb.xml new file mode 100644 index 0000000..15c2995 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/com.apple.xpcd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb new file mode 100644 index 0000000..d8004d3 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb @@ -0,0 +1,2831 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension "com.apple.sandbox.application-group") + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$")) + (require-all + (subpath "/private/var/mobile/Library/Cookies") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.sandbox.application-group") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (subpath "/private/var/mobile/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")))) + (require-all + (subpath "/private/var/mobile/Media/DCIM") + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/mobile/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/iTunes_Control/Artwork") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/System/Library/Frameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/Applications") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/AppleInternal") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.notes.objectcreation.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath "/private/var/mobile/Library/Carrier Bundles") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath "/private/var/mobile/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (require-entitlement "platform-application")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]restrictionspassword[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (subpath "/private/var/mobile/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Cookies") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.appletv.WhatsNew"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "platform-application")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (subpath "/private/var/mobile/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath "/Library/Application Support/Mail/Plugins") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (subpath "/private/var/mobile/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (subpath "/Developer") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/System/Library/PairedSyncServices/com.apple.pairedsync.mail.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail[.]jpg$" #"^/private/var/mobile/Library/SpringBoard/LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]LockBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/HomeBackground[.]cpbitmap" #"^/private/var/mobile/Library/SpringBoard/[.]HomeBackground[.]cpbitmap") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath "/private/var/mobile/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-shm") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (regex #"^/private/var/mobile/Library/GameKit/Data/[^/]+[.]gcdata$") + (literal "/private/var/mobile/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (subpath "/Library/Dictionaries") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/Library/Ringtones") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.notes.sharedstore.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath "/private/var/mobile/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-wal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath "/private/var/mobile/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.AutoWake.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Media/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (subpath "/private/var/mobile/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/mobile/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/mobile/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))))) +(allow file-read-data + (regex #"^/private/var/ea/ea[.0-9]+$")) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/GameKit/Data") + (literal "/private/var/mobile/Library/Mobile Documents") + (literal "/private/var") + (literal "/private/var/mobile/Media") + (literal "/private/var/mobile/Library") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/run/printd") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (require-all + (literal "/private/var/mobile") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.appletv.WhatsNew"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Caches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "platform-application")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$")) + (require-all + (literal "/private/var/mobile") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "platform-application")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.appletv.WhatsNew"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.notes.sharedstore.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath "/private/var/mobile/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/")) + (require-all + (literal "/private/var/mobile/Library/Cookies") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]weather[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/mobile/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (subpath "/private/var/mobile/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]restrictionspassword[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtube[.]dp[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/private/var/mobile/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.notes.objectcreation.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath "/private/var/mobile/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]accountsettings[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mail[.]composition[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MailAccount-ExtProperties[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]OTASyncAgent[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]OTASyncState[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]GMM[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]NanoMailKit[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]skyhookwireless[.]wps[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistant[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]internal[.]Voltaire[.]plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/private/var/mobile/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]itunesstored[.]plist") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath "/private/var/mobile/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal "/private/var/mobile/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath "/private/var/mobile/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (literal "/private/var/mobile/Library/Caches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/com.apple.iTunesStore/LocalStorage") + (vnode-type DIRECTORY) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal "/private/var/mobile/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music")))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (regex #"^/private/var/ea/ea[.0-9]+$") + (literal "/dev/ptmx") + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/mobile/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal "/private/var/mobile/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/private/var/mobile/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$")) + (require-all + (subpath "/private/var/mobile/Media/Purchases") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu")))))))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelContext") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (require-all + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (iokit-user-client-class "RootDomainUserClient") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow iokit-get-properties + (iokit-property "gyro-interrupt-calibration") + (iokit-property-regex #"^BackCamera") + (require-not (iokit-property-regex #"-mac-address" #"mac-address-" #".+-mac-address" #".+mac-address-")) + (iokit-property "compass-calibration") + (require-entitlement "com.apple.wifi.manager-access") + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys"))) +(allow ipc-posix-sem + (semaphore-owner self) + (extension "com.apple.sandbox.application-group")) +(allow ipc-posix-shm* + (extension "com.apple.sandbox.application-group") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-create + (ipc-posix-name-regex #"^/mono[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.assetsd.notificationServer") + (global-name "com.apple.videoconference.avconference") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.networkd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.librariand") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.passd.library") + (global-name "com.apple.gamed") + (global-name "com.apple.iTunesStore.daemon.public") + (global-name "PurplePPTServer") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.tccd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.audio.AudioConverterServer") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.prdaily") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.managedconfiguration.mdmdpush-prod") + (global-name "com.apple.lsd") + (global-name "com.apple.sandboxd") + (global-name "com.apple.iaptransportd") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.Music.MPMusicPlayerControllerInternal") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.coremedia.cpeprotector") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.mDNSResponderHelper") + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.calaccessd") + (global-name "com.apple.Music.MPMusicPlayerMigServer") + (global-name "com.apple.geod") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.commcenter.dm-helper") + (global-name "com.apple.midiserver.io") + (global-name "com.apple.springboard.UIKit.migserver") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.springboard") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.TextInput") + (global-name "com.apple.coremedia.formatreader") + (global-name "com.apple.managedconfiguration.mdmdpush-dev") + (global-name "com.apple.telephonyutilities.remotelogdaemon") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.ReportCrash.Jetsam") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.iapd.distributednotification.server") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.VoiceOverTouch") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.awdd") + (global-name "com.apple.gizmoappd") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "com.apple.webinspector") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.springboard.remotenotifications") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.audio.AudioFileServer") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.MediaControl.daemon") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.cookied") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.telephonyutilities.callservicesdaemon.voip") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.fairplayd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.iapd") + (global-name "com.apple.AdSheetPad.server") + (global-name "com.apple.bird.token") + (global-name "com.apple.gamecenter") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.imavagent.embedded.auth") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.airplay.sender.xpc") + (global-name "com.apple.iap2d.distributednotification.server") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.mobile-helper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.fig.movie") + (global-name "com.apple.springboard.alerts") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.syncdefaultsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.dataaccess.dataaccessd") + (global-name "com.apple.coremedia.capturesession") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.cloudd") + (global-name "com.apple.iapauthd") + (global-name "com.apple.mediastream.sharing-nowake") + (global-name "com.apple.ReportCrash.SafetyNet") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.atc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.VoiceOverTouch.xpc") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.healthd.restriction") + (global-name "com.apple.mobileipod.MPMusicPlayerMigServerExists") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.revisiond") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.cvmsCompAgent_armv7") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.audioprocessingtap") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.mobileipod.MPMusicPlayerControllerInternal") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.audio.AudioUnitServer") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.webfilterd") + (global-name "com.apple.weibod.server") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.AdSheetPhone.server") + (global-name "com.apple.dataaccess.dataaccessd.active") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mobileipod.MPMusicPlayerMigServer") + (global-name "com.apple.instruments.server.mig") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.sysmond") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.passd.in-app-payment") + (local-name "com.apple.cfprefsd.agent") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.testmanagerd") + (global-name "com.apple.system.logger") + (global-name "com.apple.bird") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.backboard.checkin") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.marco") + (global-name "com.apple.itdbprep.server") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.scrod") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.ReportCrash.StackShot") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.iap2d.xpc") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "ScripterServer") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.springboard.watchdogserver") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.apsd") + (global-name "com.apple.FileProvider") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.audio.SystemSounds") + (global-name "com.apple.gamed.note") + (global-name "com.apple.accountsd.accessmanager") + (global-name "com.apple.sharingd") + (global-name "com.apple.MobileFileIntegrity") + (global-name "com.apple.backboard.workspaceserverconnection") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.ait.client") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.assetsd.keepDaemonAlive") + (global-name "com.apple.xpcd") + (global-name "com.apple.iapd.xpc") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.mobile.softwareupdated") + (global-name "com.apple.vsassetd") + (global-name "com.apple.gpumemd.source") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.iaptransportd.xpc") + (global-name "com.apple.bypassBasebandAutoBooter.msgport") + (global-name "com.apple.ReportCrash.DirectoryService") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.iapauthd.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.midiserver") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.wapi.client") + (global-name "com.apple.backboard.watchdog") + (global-name "com.apple.healthd.server") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.Music.MPMusicPlayerMigServerExists") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.symptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.MobileAccessoryUpdater") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.iap2d") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.coremedia.wirelessdisplay") + (global-name "com.apple.certui.relay") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.managedconfiguration.mdmdservice") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.datamigrator.dz") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.cpe") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.accountsd.authmanager") + (global-name "com.apple.mDNSResponder") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.appleprofilepolicyd") + (global-name "com.apple.coremedia.wirelessdisplayserver") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.ReportCrash") + (global-name "com.apple.clouddbd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.iTunesStore.daemon.notifications.public") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assetsd.messagingServer") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@0v3") + (global-name "com.apple.securityd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.nesessionmanager") + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.coremedia.recorder") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.safarifetcherd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.mediaserverd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.utilitiesconnection") + (require-entitlement "com.apple.bulletinboard.utilities")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.Maps.mapspushd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.unfreed") + (require-entitlement "platform-application")) + (require-all + (local-name "com.apple.iphone.axserver") + (require-entitlement "com.apple.accessibility.api")) + (require-all + (global-name "com.apple.identityservicesd.embedded.auth") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.absinthed") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.bulletindistributord.server") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobilestoredemod") + (require-entitlement "com.apple.private.mobilestoredemo.enabledemo")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.AOSNotification") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.endpoint") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.observerconnection") + (require-entitlement "com.apple.bulletinboard.observer")) + (require-all + (global-name "com.apple.nanomaps.xpc.Maps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.Maps.SpringBoard") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.nehelper") + (require-any + (require-entitlement "com.apple.networking.vpn.configuration") + (require-entitlement "com.apple.developer.networking.vpn.api"))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.securityd.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.icloud.findmydeviced") + (require-any + (require-entitlement "com.apple.icloud.findmydeviced.access") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.lskdd") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.medialibraryd.xpc") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.bulletinboard.settings")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.admin") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.mobilesafari-settings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebSheet"))) + (require-all + (global-name "com.apple.aps.alertprovider.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.backupd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.managedconfiguration.profiled") + (require-entitlement "com.apple.managedconfiguration.profiled-access")) + (require-all + (global-name "com.apple.familycircle.agent") + (require-entitlement "com.apple.private.familycircle")) + (require-all + (global-name "com.apple.icfcallserver") + (require-entitlement "com.apple.private.icfcallserver")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.systemstateconnection") + (require-entitlement "com.apple.bulletinboard.systemstate")) + (require-all + (global-name "com.apple.SystemConfiguration.PPPController-priv") + (require-entitlement "com.apple.networking.vpn.configuration")) + (require-all + (global-name "com.apple.coremedia.asset") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.harvestd.manager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow mach-register + (require-all + (require-not (global-name-regex #"-idswake$" #".+-idswake$")) + (require-any + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (extension "com.apple.sandbox.application-group") + (require-all + (global-name "com.apple.Music.MPMusicPlayerControllerInternal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (global-name "com.apple.Music.MPMusicPlayerMigServerExists") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music")))))) +(allow network-inbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-all + (require-not (remote tcp "localhost:22")) + (require-not (remote tcp "localhost:873")) + (require-not (remote tcp "localhost:23"))) + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-not (remote tcp "localhost:62078")))) +(allow user-preference-read + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.itdbprep.server") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.network.eapclient.tls.TrustExceptions") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileslideshow") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "mediaremote") + (preference-domain "com.apple.GMM") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.madrid") + (preference-domain "com.apple.nike") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.VoiceMemos") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.messagesbadgecontroller") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.softwareupdateservicesd") + (preference-domain "com.apple.atc") + (preference-domain "com.apple.managedconfiguration.janitor") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.mobiletimer") + (preference-domain "com.apple.apsd") + (preference-domain "itdbprepserver") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mobilevpn") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.mobileme.fmf.assistant") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.certui") + (preference-domain "com.apple.mobilecal.alarmengine") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.mobilecal") + (preference-domain ".GlobalPreferences") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.preferences.network") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.OTASyncState") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobile.SyncMigrator") + (preference-domain "com.apple.MobileAddressBook") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.gamekit") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.voicemail") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.XCTest") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.imagent") + (preference-domain "com.apple.mobilestoresettings") + (preference-domain "com.apple.persistentconnection") + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.demo-settings") + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (preference-domain "com.apple.coremedia") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (preference-domain "com.apple.corevideo") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (preference-domain "com.apple.NanoMailKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.accountsettings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.AppStore") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (preference-domain "com.apple.OTASyncAgent") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.coreaudio") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.WebFoundation") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.frontrow") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.appletv.WhatsNew"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.medialibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.internal.Voltaire") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.homesharing") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.skyhookwireless.wps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.MobileStore") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.MailAccount-ExtProperties") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow user-preference-write + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.weather"))) + (require-all + (preference-domain "com.apple.internal.Voltaire") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.accountsettings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.MailAccount-ExtProperties") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.NanoMailKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.skyhookwireless.wps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.OTASyncAgent") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow process-info-pidinfo + (target self)) +(allow pseudo-tty) +(allow signal + (target self) + (require-all + (target others) + (require-entitlement "com.apple.taptoradar.extension")) + (require-all + (target others) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd")))) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-info + (require-all + (require-entitlement "fairplay-client") + (info-type "net.link.addr") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain 39) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb.xml new file mode 100644 index 0000000..a0a1131 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/container.sb.xml @@ -0,0 +1,24 @@ + + + + + + + + + +]> + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb new file mode 100644 index 0000000..286bc1b --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb @@ -0,0 +1,63 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/dev/dtracehelper"))) +(allow file-read* + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/") + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (require-all + (file-mode #o0004) + (require-any + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (literal "/tmp") + (literal "/var") + (literal "/private/etc/localtime") + (literal "/etc")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/System/Library/Caches/com.apple.coresymbolicationd") + (subpath "/private/var/root/Library/Caches/com.apple.coresymbolicationd") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.DirectoryService.libinfo_v1")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self) + (target self)) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb.xml new file mode 100644 index 0000000..42bc466 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/coresymbolicationd.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb new file mode 100644 index 0000000..e4b45f4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb @@ -0,0 +1,217 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Logs") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/System/Library/Frameworks") + (subpath "/System/Library") + (literal "/dev/aes_0") + (subpath "/private/var/logs/MobileMediaFactoryLogs") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (subpath "/private/var/logs/WirelessLibraryLogs") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/logs/MobileLibraryLogs") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/urandom") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/lib") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/logs/MobileLibraryLogs") + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath "/private/var/logs/MobileMediaFactoryLogs") + (subpath "/private/var/mobile/Library/Logs") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/cplogd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb new file mode 100644 index 0000000..481ec86 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb @@ -0,0 +1,372 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/private/var/mobile/Library/Logs/DataMigration") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/private/var/mobile/Library/Caches/DataAccess") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/DataAccess") + (subpath "/private/var/mobile/Library/Logs/DataAccess") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/Caches/com.apple.mobilesafari/ReadingListArchives") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (subpath "/private/var/mobile/Library/Logs/Message") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.sharedstore.lock") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Safari") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/mobile/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/dev/zero") + (subpath "/private/var/mobile/Library/Logs/ManagedConfiguration") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-journal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Safari/com.apple.Bookmarks.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.autoincrement.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-wal") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (literal "/private/var/mobile/Library/Logs") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-shm") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/mobile/Library/Notes") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Library/Calendar") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.objectcreation.lock") + (subpath "/AppleInternal/Library/Frameworks") + (subpath "/usr/lib") + (regex #"^/private/var/mobile/Library/Cookies/com[.]apple[.]dataaccessd[.]binarycookies" #"^/private/var/mobile/Library/Cookies/com[.]apple[.]dataaccessd[.].+binarycookies") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Library/Mail") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (require-not (regex #"^/private/var/mobile/Library/")) + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (subpath "/private/var/mobile/Library/Carrier Bundles") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db") + (subpath "/private/var/mobile/Library/Logs/Message") + (subpath "/private/var/mobile/Library/Logs/DataAccess") + (regex #"^/private/var/mobile/Library/Cookies/com[.]apple[.]dataaccessd[.]binarycookies" #"^/private/var/mobile/Library/Cookies/com[.]apple[.]dataaccessd[.].+binarycookies") + (subpath "/private/var/mobile/Library/Logs/ManagedConfiguration") + (subpath "/private/var/mobile/Library/Caches/DataAccess") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-journal") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Notes") + (literal "/private/var/mobile/Library/Safari/com.apple.Bookmarks.lock") + (subpath "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/DataAccess") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.autoincrement.lock") + (subpath "/private/var/mobile/Library/Preferences") + (subpath "/private/var/mobile/Library/Calendar") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.sharedstore.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.notes.objectcreation.lock") + (subpath "/private/var/mobile/Library/Logs/DataMigration") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/private/var/mobile/Library/Safari") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath "/private/var/mobile/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-wal") + (subpath "/private/var/mobile/Library/Mail") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db-shm") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Safari")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Safari/Bookmarks.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Caches/com.apple.mobilesafari/ReadingListArchives") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.accountsd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb.xml new file mode 100644 index 0000000..847eba8 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/dataaccessd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb new file mode 100644 index 0000000..e6873ed --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb @@ -0,0 +1,227 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+$" #"^/private/var/mobile/Containers/Bundle/[^/]+/$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+$" #"^/private/var/mobile/Containers/Bundle/[^/]+//[.]app/" #"^/private/var/mobile/Containers/Bundle/[^/]+//[.]app$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[.]app/" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[.]app$" #"^/private/var/mobile/Containers/Bundle/[^/]+//[^/]+[.]app/" #"^/private/var/mobile/Containers/Bundle/[^/]+//[^/]+[.]app$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[^/]+[.]app/" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[^/]+[.]app$") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (subpath "/usr/share") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols") + (require-all + (require-not (subpath "/private/var/mobile/Media")) + (require-not (subpath "/private/var/mobile"))))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-priv-task-port + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local tcp "localhost:*") + (remote tcp "localhost:*")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (regex #"^/private/var/run/lockdown/checkin") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (subpath "/private/var/mobile/Containers")) + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-debug) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb.xml new file mode 100644 index 0000000..7bb1f1e --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/debugserver.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb new file mode 100644 index 0000000..ed1bc4c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb @@ -0,0 +1,239 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/tmp") + (literal "/dev/null") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/dev/aes_0") + (subpath "/System/Library/CacheDelete") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.cache_delete.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/db/timezone") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/Logs/CacheDelete") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/CacheDelete") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]cache_delete[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobilegestalt.xpc") + (global-name-regex #"^com[.]apple[.].+[Cc]ache[Dd]elete$" #"^com[.]apple[.].+cache-delete$" #"^com[.]apple[.]mobile[.]cache_delete_") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd") + (global-name "com.apple.aggregated") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.cache_delete") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.cache_delete")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 24))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/deleted.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb new file mode 100644 index 0000000..4f7d027 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb @@ -0,0 +1,408 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.fmfd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/empty") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/usr/libexec/fmfd") + (extension "com.apple.sandbox.executable") + (literal "/usr/libexec") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/usr/lib") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]fmfd") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/dev/random") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/PPTDevice") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]icloud[.]fmfd[.]plist") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.tccd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.networkd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.marco") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.geod") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.apsd") + (global-name "com.apple.cookied") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cfprefsd.agent") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.da") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.icloud.fmfd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.icloud.fmfd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/fmfd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb new file mode 100644 index 0000000..5314dae --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb @@ -0,0 +1,268 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal "/dev/random") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/dev/null") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/dev/aes_0") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.tccd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.pfd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.symptomsd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.networkd") + (global-name "com.apple.cookied") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-inbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (local ip "*:*") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ftp-proxy-embedded.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb new file mode 100644 index 0000000..1617ffe --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb @@ -0,0 +1,393 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/usr/libexec/gamed") + (subpath "/Applications") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.gamed") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/GameKit") + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[^/]+[.]app$" #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/[^/]+[.]app/") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/System/Library") + (subpath "/AppleInternal/Applications") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.gamed.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Library/Logs/GameKit") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.sandbox.executable") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/gamed") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.gamecenter.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Caches/GameKit") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.VideoConference.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/usr/libexec") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/dev/null") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]gamed") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]gamed") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Library/Logs/awd") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/gamed") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]conference[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]gamed[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]gamecenter[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]logging[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/GameKit") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/Caches/GameKit") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/GameKit") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference") + (subpath "/private/var/mobile/Library/Caches/com.apple.gamed") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.networkd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.fairplayd") + (global-name "com.apple.cookied") + (global-name "com.apple.awdd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.apsd") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.marco") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.gamecenter") + (global-name "com.apple.tccd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.springboard.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.accountsd.accountmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.managedconfiguration.profiled.public") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local udp "*:*"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (remote ip "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.gamed") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.gamed") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/usr/libexec/gamed"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gamed.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb new file mode 100644 index 0000000..29a0edf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb @@ -0,0 +1,14 @@ +(version 1) +(deny default) +(allow iokit-get-properties) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self)) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb.xml new file mode 100644 index 0000000..7baaeea --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geocorrectiond.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb new file mode 100644 index 0000000..a849f39 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/CallHistoryDB") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/dev/null") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/GeoServices") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.GMM.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/private/var/mobile/Library/Logs/CallHistory") + (subpath "/System/Library") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/MapTiles") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles") + (subpath "/private/var/mobile/Library/Caches/com.apple.GeoServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/CallHistoryDB") + (subpath "/private/var/mobile/Library/Logs/CallHistory") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (subpath "/private/var/mobile/Library/GeoServices") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") + (literal "/private/var/mobile/Library/Caches/MapTiles") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") + (regex #"^/private/var/mobile/Library/Preferences/[.]GlobalPreferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]GEO[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]GMM[.]plist") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles") + (subpath "/private/var/mobile/Library/Caches/com.apple.GeoServices") + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/MapTiles")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb") + (literal "/private/var/mobile/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.securityd") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.CallHistorySyncHelper")) + (require-any + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (remote ip "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.GEO") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GMM") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/geod.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb new file mode 100644 index 0000000..ad82661 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb @@ -0,0 +1,293 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/private/var/tmp") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (subpath "/Applications") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/aes_0") + (subpath "/System/Library") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Caches/com.apple.watchkit.imagecache") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/Containers/Bundle/Application") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$") + (literal "/private/var/mobile/Library/Preferences/com.apple.gizmoappd.plist") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/PPTDevice") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]gizmoappd[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath "/private/var/mobile/Library/Caches/com.apple.watchkit.imagecache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.tccd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.carousel.glanceservice") + (global-name "com.apple.system.logger") + (global-name "com.apple.managedconfiguration.profiled.public") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.securityd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd") + (global-name "com.apple.cache_delete") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.carousel.backlightxpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.marco") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.gizmoappd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gizmoappd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb new file mode 100644 index 0000000..000fc1d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb @@ -0,0 +1,279 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/random") + (literal "/dev/urandom") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/ptmx") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/root/Library/Caches") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/root/Library/Caches/com.apple.opengl") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$") + (subpath "/private/var/mobile/Library/GPUTools") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelDevice") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelDevice2")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.assertiond.applicationstateconnection") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd") + (global-name "com.apple.assertiond.appwatchdog") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coresymbolicationd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow mach-priv-task-port + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (local tcp "localhost:*") + (literal "/private/var/run/gputoolsdhelper.sock") + (literal "/private/var/run/syslog") + (regex #"^/private/var/run/lockdown/checkin")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/Developer/usr/libexec/gputoolsd"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb.xml new file mode 100644 index 0000000..728a4ea --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/gputoolsd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb new file mode 100644 index 0000000..0069ed4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb @@ -0,0 +1,408 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (subpath "/usr/share") + (literal "/dev/ptmx") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") + (subpath "/System/Library") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.healthlite.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/Health") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/dev/zero") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Fitness.plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanolifestyle.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath "/Applications/Health.app") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanolifestyle.privacy.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.companionsync.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.healthd.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (literal "/private/var/mobile/Library/CompanionSyncCaches") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Fitness[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]healthd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]nanolifestyle[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]nanolifestyle[.]privacy[.]plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Health") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CompanionSync")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/CompanionSyncCaches"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/private/var/mobile/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.aggregated") + (global-name "com.apple.awdd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coreduetd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.hangtracerd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.marco") + (global-name "com.apple.springboard.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.healthlite") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.TelephonyUtilities") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Fitness") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.nanolifestyle.privacy") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.nanolifestyle") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.healthd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.locationd") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.nanolifestyle.privacy") + (preference-domain "com.apple.Fitness") + (preference-domain "com.apple.nanolifestyle") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/healthd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb new file mode 100644 index 0000000..191e364 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb @@ -0,0 +1,343 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/ea") + (literal "/private/var/mobile/Library/Preferences/com.apple.iap2d.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/dev/aes_0") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/iapd" #"^/private/var/mobile/Library/Logs/CrashReporter/iap2d" #"^/private/var/mobile/Library/Logs/CrashReporter/mp" #"^/private/var/mobile/Library/Logs/CrashReporter/haywire" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistivetouchd[.]enabled[.]launchd") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Caches/com.apple.iap2d") + (literal "/dev/zero") + (literal "/dev/random") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (regex #"^/private/var/ea/ea[.0-9]+$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/Panics") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Media/Radio") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iapd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iaptransportd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Media/iTunes_Control") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/CallHistoryDB") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/sbin") + (literal "/dev/urandom") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Library/Caches/com.apple.iap2d") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/iapd" #"^/private/var/mobile/Library/Logs/CrashReporter/iap2d" #"^/private/var/mobile/Library/Logs/CrashReporter/mp" #"^/private/var/mobile/Library/Logs/CrashReporter/haywire" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]assistivetouchd[.]enabled[.]launchd" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iapd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iap2d[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]iaptransportd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaremote[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileipod[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]videos[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Media/Radio") + (subpath "/private/var/mobile/Library/CallHistoryDB") + (subpath "/private/var/mobile/Media/iTunes_Control") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/Panics") + (regex #"^/private/var/ea/ea[.0-9]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]iapd$")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server")) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local udp "*:*"))) +(allow network-bind + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/private/var/ea/ea[.0-9]+$"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iaptransportd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.iap2d") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.videos") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.da") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.homesharing") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.videos") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.iap2d") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.iaptransportd") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iap2d") + (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iapd")))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-kext-load + (kext-bundle-id "com.apple.driver.AppleUSBNCM") + (kext-bundle-id "com.apple.iokit.IOUSBHIDDriver") + (kext-bundle-id "com.apple.driver.AppleUSBAudio")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb.xml new file mode 100644 index 0000000..5831a8c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/iapd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb new file mode 100644 index 0000000..dcdfbf5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb @@ -0,0 +1,327 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension "com.apple.sandbox.application-group") + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/dev/zero") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/dev/urandom") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelContext2") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.fig.movie") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.springboard.services") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.aggregated") + (global-name "com.apple.backboard.display.services") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow mach-register + (local-name "com.apple.iphone.axserver")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info-pidinfo + (target self)) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb.xml new file mode 100644 index 0000000..982b8d8 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/keyboard.sb.xml @@ -0,0 +1,25 @@ + + + + + + + + + +]> + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb new file mode 100644 index 0000000..5d3c5a9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb @@ -0,0 +1,242 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.librarian.ubiquity-container"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand.+[.]log") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Mobile Documents") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/tmp") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Application Support") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.librariand.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath "/private/var/mobile/Library/Application Support/Librarian") + (literal "/dev/urandom") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Mobile Documents") + (subpath "/private/var/mobile/Library/Application Support/Librarian") + (literal "/private/var/mobile/Library/Application Support") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]appleaccount[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand.+[.]log" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]librariand[.]plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobile.installd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.ubd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.librariand") + (preference-domain "com.apple.appleaccount") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.appleaccount") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.librariand")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/librariand.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb new file mode 100644 index 0000000..4ae2ad4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb @@ -0,0 +1,216 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdLib.plist") + (literal "/usr/libexec/limitadtrackingd") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/usr/libexec") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.AdSheetPhone.management") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.AdLib") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/limitadtrackingd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb new file mode 100644 index 0000000..08cdc30 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (subpath "/AppleInternal/Lockdown") + (literal "/private/var/db/launchd.db/com.apple.launchd/overrides.plist") + (subpath "/System/Library") + (literal "/private/etc/master.passwd") + (literal "/private/var/mobile/Library/Preferences/com.apple.purplebuddy.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/logs") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$") + (literal "/usr/libexec/lockdownd") + (literal "/dev/random") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/private/var/mobile/Media") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Applications/Preferences.app") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/db/timezone") + (literal "/dev/zero") + (subpath "/private/var/run/lockdown") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]mobile[.]lockdownd[.]plist") + (subpath "/private/var/root/Library/Lockdown") + (subpath "/Developer") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/preferences/SystemConfiguration") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/usr/libexec") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all + (subpath "/private/var/mobile/Library/Notes") + (vnode-type DIRECTORY)) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Media") + (vnode-type DIRECTORY)) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath "/private/var/mobile/Library/Calendar") + (vnode-type DIRECTORY)) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Voicemail") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Applications") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/tmp/MediaCache") + (vnode-type DIRECTORY)) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/Library/Caches/com.apple.WebAppCache") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/mobile/Containers") + (vnode-type DIRECTORY))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Media") + (subpath "/private/var/run/lockdown") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]mobile[.]lockdownd[.]plist") + (subpath "/private/var/logs") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/root/Library/Lockdown") + (subpath "/private/var/preferences/SystemConfiguration") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/db/timezone") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleEffaceableStorageUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "AppleNANDFTLUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "auto-boot")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobile.notification_proxy") + (global-name "com.apple.crashreportcopymobile") + (global-name "com.apple.lsd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.syslog_relay") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.webinspector") + (global-name "com.apple.mobile.assertion_agent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.afcd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.mobile.installation_proxy") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.atc2") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.crash_mover") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.streaming_zip_conduit") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.aggregated") + (global-name "com.apple.AOSNotification") + (global-name "com.apple.mobile.insecure_notification_proxy") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name-regex #"^lockdown[.]") + (global-name "com.apple.ait.client") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.atc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/run/lockdown") + (local tcp "*:*") + (literal "/private/var/run/lockdown.sock")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockbot") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.purplebuddy") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/lockdownd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb new file mode 100644 index 0000000..7d0e5eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb @@ -0,0 +1,129 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/dev/dtracehelper"))) +(allow file-read* + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/private/var/Managed Preferences/mobile") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds/" #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds$" #"^/private/var/folders/[^/]+/[^/]+/C/mds/" #"^/private/var/folders/[^/]+/[^/]+/C/mds$" #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$" #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (literal "/private/var/run/mDNSResponder") + (literal "/Library/Managed Preferences") + (literal "/private/var/Library/Preferences/") + (literal "/private/var/Managed Preferences/mobile/com.apple.mDNSResponder.plist") + (literal "/dev/null") + (require-all + (file-mode #o0004) + (require-any + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System") + (subpath "/private/var/db/dyld")))) +(allow file-read-data + (subpath "/private/var/tmp/mds") + (subpath "/private/var/db/mds") + (literal "/Library/Keychains/System.keychain") + (literal "/private/var/db/crls/crlcache.db") + (require-all + (require-not (regex #"^/Library/Keychains/")) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (regex #"^/Library/Preferences/[.]GlobalPreferences[.]" #"^/Library/Preferences/ByHost/[.]GlobalPreferences[.]") + (regex #"^/Library/Preferences/com[.]apple[.]security[.]") + (literal "/Library/Security/Trust Settings/Admin.plist") + (literal "/Library/Preferences/SystemConfiguration/preferences.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.nat.plist") + (literal "/dev/console") + (literal "/usr/sbin") + (literal "/usr/sbin/mDNSResponder") + (literal "/Library/Preferences/com.apple.crypto.plist")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/run/mDNSResponder") + (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds/" #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds$" #"^/private/var/folders/[^/]+/[^/]+/C/mds/" #"^/private/var/folders/[^/]+/[^/]+/C/mds$" #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$" #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/console") + (literal "/dev/null")))) +(allow iokit-open + (iokit-user-client-class "mDNSOffloadUserClient") + (iokit-user-client-class "wlDNSOffloadUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "NVEthernetUserClientMDNS") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.blued") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.webcontentfilter.dns") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.networkd") + (global-name "com.apple.distributed_notifications.2") + (global-name "com.apple.bsd.dirhelper") + (global-name "com.apple.system.logger") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.ocspd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.snhelper") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.awacs") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration")) +(allow mach-register + (global-name "com.apple.d2d.ipc")) +(allow network* + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self) + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb.xml new file mode 100644 index 0000000..024e7ad --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mDNSResponder.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb new file mode 100644 index 0000000..9d2f840 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb @@ -0,0 +1,592 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.rtcreporting.upload") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference/logs/mediaserverd"))))) +(allow file-read* + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.airplay.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.rtcreporting.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (subpath "/private/var/mobile/Media/PhotoData/CPLAssets") + (subpath "/Developer") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (subpath "/usr/lib") + (extension "com.apple.mediaserverd.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.VideoConference.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/mobile/Library/Logs/AirPlay[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/mediaserverd") + (literal "/private/var/mobile/Library/Preferences/com.apple.voicetrigger.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.settings.bluetooth.audio-route.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.audio.virtualaudio.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Media/PhotoData/Mutations") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Music") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/VoiceTrigger") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/logs/mediaserverd") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/mobile/Library/VoiceTrigger") + (literal "/private/var/mobile/Library/Preferences/com.apple.celestial.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences-sounds.plist") + (subpath "/Library") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.imessage.bag.plist") + (subpath "/private/var/mobile/Media/Podcasts") + (literal "/private/var/mobile/Library/Preferences/com.apple.voicetrigger.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/mobile/Media/PhotoData/Sync") + (subpath "/usr/local/share/firmware/isp") + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/mobile/Library/Fonts") + (literal "/dev/zero") + (literal "/private/var/tmp/AirTunesHALPlugin.log") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.springboard.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/mobile/Media/Purchases") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mediaserverd") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Caches/CoreMotion/CoreMotion.log") + (subpath "/usr/local/lib") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.mediaserverd.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.VideoProcessing.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Media/Recordings") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/Logs/awd") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.facetime.bag.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$") + (literal "/usr/sbin/mediaserverd") + (subpath "/private/var/wireless/Library/Logs/awd") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (subpath "/private/var/mobile/Media/Downloads") + (extension "com.apple.sandbox.executable") + (subpath "/usr/sbin") + (subpath "/System/Library/Frameworks") + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/AppleInternal/Library/Conference/Environments.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.audio.penguin.plist") + (subpath "/private/var/mobile/Media/DCIM") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.facetime.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/tmp/AirTunesHALPlugin.log") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/mobile/Media/iTunes_Control/Music") + (subpath "/private/var/mobile/Media/Downloads") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/VoiceTrigger") + (subpath "/private/var/mobile/Media/Purchases") + (subpath "/private/var/logs/mediaserverd") + (subpath "/private/var/mobile/Media/PhotoData/CPLAssets") + (subpath "/private/var/mobile/Library/VoiceTrigger") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/CoreMotion/CoreMotion.log") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.mediaserverd.read-write") + (extension "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media/Podcasts") + (subpath "/private/var/mobile/Media/PhotoStreamsData") + (subpath "/private/var/mobile/Media/iTunes_Control/Ringtones") + (subpath "/private/var/mobile/Library/Caches/com.apple.VideoConference") + (subpath "/private/var/mobile/Library/Logs/awd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]airplay[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]voicetrigger[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]voicetrigger[.]notbackedup[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]avfoundation[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]coremedia[.]plist" #"^/private/var/mobile/Library/Logs/AirPlay[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/mediaserverd" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]audio[.]penguin[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]audio[.]virtualaudio[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]celestial[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]conference[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]coreaudio[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]facetime[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]facetime[.]bag[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]imessage[.]bag[.]plist" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath "/private/var/mobile/Media/Recordings") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Media/PhotoData/Sync") + (subpath "/private/var/mobile/Media/DCIM") + (subpath "/private/var/tmp/MediaCache") + (subpath "/private/var/wireless/Library/Logs/awd") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media/PhotoData/Mutations") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/CoreMotion")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CrashReporter"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccessoryManagerUserClient") + (iokit-user-client-class "IOAudio2TransformerUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOUSBInterfaceUserClientV2") + (iokit-user-client-class "IOAudioCodecsUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "AppleH6CamInUserClient") + (iokit-user-client-class "AppleH2CamInUserClient") + (iokit-user-client-class "AppleH3CamInUserClient") + (iokit-user-client-class "AppleH4CamInUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOUSBDeviceInterfaceUserClient") + (iokit-user-client-class "AppleVXD375UserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "AppleVXE380UserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleVXD390UserClient") + (iokit-user-client-class "AppleAVEUserClient") + (iokit-user-client-class "AppleVXD393UserClient") + (iokit-user-client-class "IOStreamAudioUserClient") + (iokit-user-client-class "H3H264VideoEncoderDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAudio2DeviceUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelDevice2")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "shm_pcm_audio_sco_read") + (ipc-posix-name "shm_pcm_audio_sco_write") + (ipc-posix-name-regex #"^[0-9A-F][0-9A-F]:+[0-9A-F][0-9A-F]-tacl$" #"^shm_notif[.][^.]+[.][RW]$" #"^com[.]apple[.]audio[.]abl[.]" #"^AppleAudioQueue[.]." #"^AppleAURemoteIO[.]." #"^AppleABL[.]." #"^AppleAudioQueue[.].+" #"^AppleAURemoteIO[.].+" #"^AppleABL[.].+") + (ipc-posix-name "shm_pcm_audio_acl") + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.aggregated") + (global-name "com.apple.iapd.xpc") + (global-name "com.apple.carkit.service") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.b184_mcu_commd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.virtualdisplayserver") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.cookied") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.GSSCred") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.iaptransportd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.securekeyvaultd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.iap2d.distributednotification.server") + (global-name "com.apple.nsurlstorage-cache") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.NetworkLinkConditioner") + (global-name "com.apple.springboard.services") + (global-name "com.apple.apsd") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.SystemConfiguration.helper") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.awdd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.lskdmsed") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.b184_monitord") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.iapd.distributednotification.server") + (global-name "com.apple.coreduetd") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.lskdd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.iap2d.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.filesystems.userfsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.lsd") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.symptomsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.audio.SystemSounds") + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.midiserver.io") + (global-name-regex #"^com[.]apple[.]coremedia[.]")) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local tcp "*:*") + (local udp "*:*")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.voicetrigger.notbackedup") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.settings.bluetooth.audio-route") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.corevideo") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.facetime") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.audio.penguin") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.da") + (preference-domain "com.apple.audio.virtualaudio") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.locationd") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.facetime") + (preference-domain "com.apple.audio.penguin") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.voicetrigger.notbackedup") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.audio.virtualaudio") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/usr/sbin/mediaserverd") + (require-all + (debug-mode) + (require-any + (literal "/usr/bin/trace") + (literal "/usr/bin/syslog")))))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) +(allow system-suspend-resume) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb.xml new file mode 100644 index 0000000..6f43bc4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mediaserverd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb new file mode 100644 index 0000000..712ccc9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb @@ -0,0 +1,299 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (subpath "/usr/share") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.afc.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/urandom") + (literal "/dev/random") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal "/dev/null") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/usr/libexec/mobile_house_arrest") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-data + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/GeoJSON$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (local-name "com.apple.cfprefsd.agent") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.afc") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobile-house-arrest.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb new file mode 100644 index 0000000..3dff23b --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb @@ -0,0 +1,358 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.assets.read") + (require-any + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/VoiceServices") + (subpath "/private/var/mobile/Library/PreinstalledAssets") + (subpath "/private/var/mobile/Library/Assets"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/VoiceServices") + (subpath "/private/var/mobile/Library/PreinstalledAssets") + (subpath "/private/var/mobile/Library/Assets"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]MobileAsset[.]plist" #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$") + (literal "/private/var/mobile/Library/VoiceServices") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/usr/lib") + (literal "/private/var/root/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/tmp") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/urandom") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$") + (subpath "/AppleInternal/Library/PreinstalledAssets") + (literal "/private/etc/master.passwd") + (literal "/private/var/mobile/Library/Preferences/com.apple.AssetCacheLocator.plist") + (literal "/") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/PreinstalledAssets") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/root/Library/Cookies$" #"^/private/var/root/Library/Cookies/Cookies[.]binarycookies") + (literal "/dev/null") + (literal "/usr/libexec/mobileassetd") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$"))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Assets") + (literal "/private/var/mobile/Library/VoiceServices") + (subpath "/private/var/mobile/Library/PreinstalledAssets") + (regex #"^/private/var/root/Library/Cookies$" #"^/private/var/root/Library/Cookies/Cookies[.]binarycookies" #"^/private/var/root/Library/Preferences/com[.]apple[.]MobileAsset[.]plist" #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MobileAsset[.]plist" #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.networkd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd") + (global-name "com.apple.tccd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cookied") + (global-name "com.apple.cache_delete") + (global-name "com.apple.aggregated") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AssetCacheLocator") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb.xml new file mode 100644 index 0000000..44a376c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/mobileassetd.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb new file mode 100644 index 0000000..8846811 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb @@ -0,0 +1,286 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoMail.plist") + (literal "/dev/ptmx") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/null") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoMailKitClient.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/NanoMailKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/PPTDevice") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/NanoMailKit") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]NanoMailKitClient[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nanomaild$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.NanoMailKitClient") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMail") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMailKitClient")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomaild.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb new file mode 100644 index 0000000..d474ddc --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb @@ -0,0 +1,403 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/private/var/db/timezone") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/tmp") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-nanomapscd[.]log" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapsSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.companionsync.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/awd") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/PPTDevice") + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (literal "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync")))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-nanomapscd[.]log" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]MapsSupport[.]plist") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CompanionSync")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.securityd") + (global-name "com.apple.routined.registration") + (global-name "com.apple.Maps.IPC") + (global-name "com.apple.Maps.gsEvents") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cookied") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.awdd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.tccd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.marco") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.networkd") + (global-name "com.apple.Maps.SpringBoard") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.geod") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")) +(allow user-preference-read + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.demo-settings") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MapsSupport")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapscd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb new file mode 100644 index 0000000..3af464e --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb @@ -0,0 +1,363 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.conference.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/Applications/NanoMaps.app") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-nanomapsgd[.]log" #"^/private/var/mobile/Library/MapsHistory[.]plist" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoMaps.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Library/Maps") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.ids.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/usr/share") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/usr/lib") + (subpath "/System/Library") + (subpath "/private/var/tmp") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.companionsync.plist") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/PPTDevice") + (literal "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Maps") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-nanomapsgd[.]log" #"^/private/var/mobile/Library/MapsHistory[.]plist" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]NanoMaps[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-wal") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-journal") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db-shm") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath "/private/var/mobile/Library/Logs/CompanionSync/TransportLogs") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/CompanionSync")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CompanionSync") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.tccd") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.marco") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.system.logger") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.geod") + (global-name "com.apple.assertiond.processassertionconnection") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.NanoMaps") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.demo-settings") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMaps")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nanomapsgd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb new file mode 100644 index 0000000..b239d5c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/tty.stockholm") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.awd.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-nfcd[.]log" #"^/private/var/mobile/Library/Logs/com[.]apple[.]nfcd[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com[.]apple[.]nfcd_") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/dev/tty.stockholm") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.Duet.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (subpath "/System/Library") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/usr/libexec/nfcd") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/run/syslog") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-nfcd[.]log" #"^/private/var/mobile/Library/Logs/com[.]apple[.]nfcd[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com[.]apple[.]nfcd_" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]awd[.]plist") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/tty.stockholm") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleStockholmControlUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.awdd") + (global-name "com.apple.tccd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.system.logger") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (control-name "com.apple.uart.stockholm") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Duet") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.stockholm") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_SYSTEM)) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nfcd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb new file mode 100644 index 0000000..9402004 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb @@ -0,0 +1,229 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/System/Library/Frameworks") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.logger") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.pfd") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.notification_center") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb.xml new file mode 100644 index 0000000..d8a3680 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nlcd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb new file mode 100644 index 0000000..d13ea38 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb @@ -0,0 +1,19 @@ +(version 1) +(allow default) +(deny file* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-chroot + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny file-write-create + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network* + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/") + (local ip "*:*")) +(deny network-inbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-bind + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) +(deny network-outbound + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) +(deny process-exec-interpreter + (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb.xml new file mode 100644 index 0000000..fa56c88 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nointernet.sb.xml @@ -0,0 +1,20 @@ + + + + + + + + + +]> + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb new file mode 100644 index 0000000..f952ec1 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb @@ -0,0 +1,375 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Logs/com.apple.nsurlsessiond") + (literal "/usr/libexec") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/tmp") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/Library/com.apple.nsurlsessiond") + (subpath "/private/var/mobile/Media/Downloads") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (literal "/usr/libexec/nsurlsessiond") + (literal "/private/var/mobile/Library/Preferences/com.apple.nsurlsessiond.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.Duet.plist") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]coremedia")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/random") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/mobile/Media/Downloads") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]nsurlsessiond[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath "/private/var/mobile/Library/Logs/com.apple.nsurlsessiond") + (subpath "/private/var/mobile/Library/com.apple.nsurlsessiond") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs")))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.coreduetd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.fig.movie") + (global-name "com.apple.ocspd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.hangtracerd") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.CARenderServer")) + (require-any + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.tccd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.nsurlsessiond") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.Duet") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.coremedia") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.nsurlsessiond")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlsessiond.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb new file mode 100644 index 0000000..55270e3 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb @@ -0,0 +1,254 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Applications") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/ptmx") + (subpath "/usr/libexec") + (literal "/dev/random") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/private/var/db/timezone") + (subpath "/private/var/tmp") + (literal "/dev/null") + (literal "/private/etc/master.passwd") + (subpath "/usr/lib") + (literal "/dev/urandom") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Containers") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (extension "com.apple.nsurlstorage.extension-cache") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.nsurlstorage.extension-cache") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/nsurlstoraged.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb new file mode 100644 index 0000000..9f91048 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.biometrickitd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (subpath "/usr/lib") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/random") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]passd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]passd") + (literal "/dev/ptmx") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.purplebuddy.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/mobile/Library/Passes") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/tmp") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.passd.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.ConfigServer.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath "/private/var/mobile/Library/Caches/PassKit") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$") + (literal "/private/var/mobile/Library/Preferences/com.apple.AdLib.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.revisiond.revision") + (extension "com.apple.app-sandbox.read"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/private/var/mobile/Library/Caches/com.apple.pep.configuration.plist") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$") + (subpath "/private/var/mobile/Library/Passes") + (subpath "/private/var/mobile/Library/Cookies") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]passd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]passd") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]passd[.]plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Caches/PassKit") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]plist") + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd$")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]passd$"))))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "reportStatusMessages")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.tccd") + (global-name "com.apple.seld") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.system.logger") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.revisiond") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.librariand") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.bird.token") + (global-name "com.apple.springboard.services") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.AdSheetPhone.analytics") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nfcd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.symptomsd") + (global-name "com.apple.springboard.carditemscontroller") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.icloud.findmydeviced") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.geod") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.bird") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.FileProvider") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.cookied") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.fig.movie") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.GSSCred") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.apsd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.locationd.spi") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote ip "*:*") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.locationd") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.passd") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.biometrickitd") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.stockholm") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.passd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb.xml new file mode 100644 index 0000000..d118cf1 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/passd.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb new file mode 100644 index 0000000..97e8831 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb @@ -0,0 +1,232 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/pfm") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/dev/urandom") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (subpath "/System/Library") + (literal "/dev/pfm") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/pfm") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-read-data + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.tccd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/pfd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb new file mode 100644 index 0000000..8287bee --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb @@ -0,0 +1,301 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/random") + (subpath "/private/var/run/printd") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.printd.plist") + (subpath "/private/var/mobile/Library/com.apple.printd") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/tmp") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$") + (subpath "/usr/share") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/com.apple.printd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]printd[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$") + (subpath "/private/var/run/printd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]printd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.springboard.services") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.networkd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cookied") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.tccd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptomsd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow network-inbound + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (local tcp "*:*"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.printd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.printd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/printd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb new file mode 100644 index 0000000..7f9c6d0 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb @@ -0,0 +1,232 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (regex #"^/private/var/mobile/Library/Logs/ptpd[.]log$") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Media") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (subpath "/private/var/tmp") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (subpath "/System/Library/PrivateFrameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal "/dev/random") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/") + (require-not (subpath "/private/var/mobile")) + (literal "/private/etc/hosts") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CrashReporter")))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Media") + (regex #"^/private/var/mobile/Library/Logs/ptpd[.]log$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]ImageCaptureFramework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mobileslideshow[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Logs/CrashReporter"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ImageCaptureFramework") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileslideshow")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb.xml new file mode 100644 index 0000000..7dd92d4 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/ptpd.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb new file mode 100644 index 0000000..667bdc7 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb @@ -0,0 +1,855 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension "com.apple.assets.read") + (subpath "/private/var/mobile/Library/Assets") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/mobile/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.quicklook.readonly") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (subpath "/private/var/mobile/Library/Carrier Bundles/Overlay") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Preferences/com.apple.homesharing.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Caches/DateFormats.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/mobile/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.voiceservices.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreMotion.plist") + (subpath "/private/var/mobile/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.UIKit.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (literal "/private/var/mobile/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (extension "com.apple.quicklook.readonly") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/mobile/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/Caches/com.apple.IconsCache") + (literal "/private/var/mobile/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal "/private/var/mobile/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebUI.plist") + (subpath "/private/var/mobile/Library/Fonts") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/mobile/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.medialibrary.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.da.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/private/var/mobile/Library/VoiceServices/Assets") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/TypologyRecording.framework") + (subpath "/Library/Dictionaries") + (literal "/private/var/mobile/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (require-not (subpath "/private/var/mobile/Library/Carrier Bundles")) + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/private/var/tmp/MediaCache") + (literal "/private/var/mobile/Library/Caches/Checkpoint.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mediaremote.plist") + (require-all + (literal "/private/var/mobile/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath "/private/var/mobile/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/WebKit") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (literal "/private/var/mobile/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.demo-settings.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.youtubeframework.plist") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.videos.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal "/private/var/mobile/Library/WebKit/Databases") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (subpath "/private/var/tmp") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/private/var/mobile/Library/WebClips") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/Preferences/com.apple.aggregated.plist") + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd.savedState/") + (literal "/private/var/mobile/Library/Preferences/com.apple.assistant.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]quicklook[.]quicklookd[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd-.+[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (subpath "/private/var/mobile/Media/Safari") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebKit.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Media/PhotoData/Photos.sqlite$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-wal$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-shm$" #"^/private/var/mobile/Media/PhotoData/Photos.sqlite-journal$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/mobile/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.avasset.read-only") + (subpath "/private/var/mobile/Media") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath "/private/var/mobile/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.revisiond.revision"))) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.revisiond.staging"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal "/private/var/mobile/Library/Caches")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]springboard[.]plist")) + (require-not (literal "/private/var/mobile/Library/Caches/DateFormats.plist")) + (require-any + (literal "/private/var/mobile/Library/Preferences/com.apple.dataaccess.launchd") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]mediaaccessibility[.]public[.]plist") + (literal "/private/var/mobile/Library/Keyboard/LocalDictionary") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]EmojiPreferences[.]plist") + (subpath "/private/var/mobile/Library/Caches/com.apple.keyboards") + (subpath "/private/var/tmp/MediaCache") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath "/private/var/.DocumentRevisions-V100/staging") + (require-any + (extension "com.apple.revisiond.staging") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/private/var/mobile/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (subpath "/private/var/mobile/Media")) + (require-any + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-wal") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Media/Safari") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-journal") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-shm") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-wal") + (subpath "/private/var/mobile/Library/WebClips") + (literal "/private/var/mobile/Library/WebKit/LocalStorage") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Preferences[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]youtubeframework[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]WebFoundation[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]quicklook[.]quicklookd[.]plist" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd.savedState/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath "/private/var/mobile/Library/WebKit") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db-journal") + (literal "/private/var/mobile/Library/WebKit/Databases") + (subpath "/private/var/mobile/Library/WebKit/LocalStorage") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db-shm") + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/Databases")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/WebKit/LocalStorage")))))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Media/iTunes_Control/iTunes"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]Accessibility[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]UIKit[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd.savedState"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/mobile/Library/WebKit/Databases/Databases.db") + (literal "/private/var/mobile/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$" #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.librariand") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.TextInput") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.sharingd.nsxpc") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.aggregated") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.tccd") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.webinspector") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd") + (global-name-regex #"^com.apple.uikit.viewservice..+") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.securityd") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard.services") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.bird.token") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.UIKit.pasteboardd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.bird") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.FileCoordination") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.networkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.calaccessd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.marco") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.cookied") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.webfilterd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "ScripterServer") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.FileProvider") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.backboard.hid.services") + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.endpoint") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (global-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/lockdown.sock")) +(allow user-preference-read + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.SpeakSelection") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.da") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.Sharing") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.youtubeframework") + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/quicklookd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb new file mode 100644 index 0000000..6dc9e71 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb @@ -0,0 +1,142 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/etc/master.passwd") + (subpath "/private/etc/racoon") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (subpath "/private/var/run/racoon") + (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") + (literal "/dev/dtracehelper")))) +(allow file-read* + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/preferences") + (subpath "/private/var/root") + (subpath "/private/etc/racoon") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/sha1_0") + (literal "/private/var/db/icu") + (literal "/dev/zero") + (subpath "/private/var/run/racoon") + (literal "/dev/random") + (literal "/private/var/run/racoon.sock") + (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") + (literal "/private/var/run/racoon.pid") + (subpath "/private/var/db/timezone") + (literal "/Library/Managed Preferences/mobile") + (literal "/private/var/log/racoon.log") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/etc/master.passwd") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/dev/dtracehelper") + (literal "/Library/Managed Preferences") + (literal "/dev/null") + (literal "/Library/Preferences") + (subpath "/private/var/Managed Preferences/mobile") + (require-all + (file-mode #o0004) + (require-any + (subpath "/usr/sbin") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/System"))) + (require-all + (file-mode #o0004) + (require-any + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (literal "/tmp") + (literal "/var") + (literal "/etc") + (literal "/etc") + (literal "/var") + (literal "/private/etc/localtime") + (literal "/tmp")) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/run/racoon.sock") + (literal "/private/var/log/racoon.log") + (literal "/private/var/run/racoon.pid") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/null")))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]") + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.ocspd") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.aggregated")) +(allow network* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (local udp "*:500") + (remote udp "*:*") + (local udp "*:4500") + (literal "/private/var/run/racoon.sock")))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (control-name "com.apple.net.ipsec_control") + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self) + (target self)) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb.xml new file mode 100644 index 0000000..582149f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/racoon.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb new file mode 100644 index 0000000..4a46a3a --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb @@ -0,0 +1,238 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/urandom") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/ptmx") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/null") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreSuggestions.MobileAssets.plist") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type SYMLINK) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.logger") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mobileassetd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.webinspector") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobilegestalt.xpc") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/reversetemplated.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb new file mode 100644 index 0000000..fa4ac06 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb @@ -0,0 +1,245 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.revisiond.revision") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.revisiond.staging") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/aes_0") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/tmp") + (subpath "/private/var/log/com.apple.revisiond") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.revisiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.processassertionconnection") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 13)) + (fsctl-command (_IO "h" 31))) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb.xml new file mode 100644 index 0000000..a453c1b --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/revisiond.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb new file mode 100644 index 0000000..19ae18f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb @@ -0,0 +1,405 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$"))))) +(allow file-read* + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.routined.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/usr/libexec/routined") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Applications") + (subpath "/System/Library") + (subpath "/Library/Audio/Plug-Ins") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Logs/awd/awd-routined[.]log" #"^/private/var/Managed Preferences/mobile/com[.]apple[.]routined[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.locationd.plist") + (subpath "/AppleInternal") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System") + (literal "/usr/libexec") + (subpath "/private/var/mobile/Library/Assets") + (subpath "/private/var/mobile/Library/Logs/com.apple.routined") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/Developer") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Containers/Bundle") + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (literal "/dev/ptmx") + (literal "/dev/random") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/com.apple.GEO.plist") + (subpath "/private/var/mobile/Library/Caches/GeoServices") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Logs/awd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]routined[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-routined[.]log" #"^/private/var/Managed Preferences/mobile/com[.]apple[.]routined[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") + (subpath "/private/var/mobile/Library/Logs/com.apple.routined") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal "/private/var/mobile/Library/Caches/GeoServices/tguid.bin")) + (require-any + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]routined$")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches"))))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.aggregated") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.cookied") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.locationd.routine") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.calaccessd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.geod") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.awdd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.coremedia.endpoint") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.carkit.service") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.logger") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:443") + (remote tcp "*:80") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.locationd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.routined") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.TelephonyUtilities") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.routined") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (literal "/usr/bin/ditto"))) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb.xml new file mode 100644 index 0000000..601522d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/routined.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb new file mode 100644 index 0000000..68d732d --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb @@ -0,0 +1,368 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.tsmreg.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal "/usr/libexec/seld") + (literal "/dev/null") + (literal "/usr/libexec") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]seld" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]seld") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library/Frameworks") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.stockholm.awd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/System/Library/StockholmPlugins") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.passbook.plist") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-seld[.]log" #"^/private/var/mobile/Library/Logs/com[.]apple[.]seld[.]log" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld[.]seinfo[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com[.]apple[.]seld_") + (subpath "/private/var/tmp") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Logs/awd/awd-seld[.]log" #"^/private/var/mobile/Library/Logs/com[.]apple[.]seld[.]log" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld[.]seinfo[.]plist" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com[.]apple[.]seld_" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]awd[.]plist" #"^/private/var/mobile/Library/Preferences/com[.]apple[.]stockholm[.]tsmreg[.]plist" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]seld" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]seld") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]seld$"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/CrashReporter") + (literal "/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Logs/awd"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleSSEUserClient") + (iokit-user-client-class "AppleCredentialManagerUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.nfcd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.aggregated") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.securityd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.apsd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.awdd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.tccd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cookied") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.system.logger") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nsurlsessiond") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.seld.aps")) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.passbook") + (preference-domain "com.apple.NanoRegistry") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.tsmreg") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/seld.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb new file mode 100644 index 0000000..29a0edf --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb @@ -0,0 +1,14 @@ +(version 1) +(deny default) +(allow iokit-get-properties) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow signal + (target self)) +(allow system-privilege) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb.xml new file mode 100644 index 0000000..7baaeea --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/sharingd.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb new file mode 100644 index 0000000..35758ec --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb @@ -0,0 +1,289 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/mobile/MobileSoftwareUpdate/restore.log") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/db/UpdateMetrics") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal "/dev/null") + (literal "/dev/aes_0") + (literal "/dev/random") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileSoftwareUpdate.plist") + (literal "/dev/urandom") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/MobileSoftwareUpdate") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/MobileSoftwareUpdate"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (subpath "/private/var/db/UpdateMetrics") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/OTAUpdate-") + (literal "/private/var/mobile/MobileSoftwareUpdate/restore.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/MobileSoftwareUpdate"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-set-properties + (iokit-property "IONVRAM-DELETE-PROPERTY")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.sharingd.NSURLSessionProxyService") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.GSSCred") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.symptomsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cookied") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.networkd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.accountsd.accountmanager") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.MobileSoftwareUpdate") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/softwareupdated.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb new file mode 100644 index 0000000..96036ef --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath "/private/var/mobile/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/usr/libexec/streaming_zip_conduit") + (subpath "/System/Library/Frameworks") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/dev/urandom") + (subpath "/private/var/db/timezone") + (subpath "/private/var/mobile/Containers/Bundle") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.StreamingUnzipService.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/aes_0") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/usr/libexec") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Media"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/mobile/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/mobile/Media")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/mobile/Media"))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.system.logger") + (global-name "com.apple.securityd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.lockdown.host_watcher") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.StreamingUnzipService") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/streaming_zip_conduit.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb new file mode 100644 index 0000000..ebc5a20 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb @@ -0,0 +1,293 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Calendar") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.suggestions.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/mobile/Library/Suggestions") + (subpath "/usr/lib") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreSuggestions.MobileAssets.plist") + (subpath "/private/var/mobile/Library/CallHistoryDB") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (literal "/private/var/mobile/Library/Preferences/com.apple.CoreSuggestions.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (literal "/private/var/mobile/Library/SyncedPreferences/com.apple.CoreSuggestions.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilecal.plist") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/aes_0") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/tmp") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]suggestions[.]plist") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/mobile/Library/Calendar") + (subpath "/private/var/mobile/Library/Suggestions") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.reversetemplated") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.syncdefaultsd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.calaccessd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.commcenter.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.CoreSuggestions") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mobilecal") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/suggestd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb new file mode 100644 index 0000000..ab4121a --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb @@ -0,0 +1,291 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/mobile/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]syncdefaultsd") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Preferences/com.apple.accountsd.plist") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/ConfigurationProfiles") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (literal "/dev/null") + (subpath "/private/var/Managed Preferences/mobile") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/mobile/Library/Cookies") + (subpath "/System/Library/Frameworks") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/SyncedPreferences") + (subpath "/usr/lib") + (subpath "/private/var/tmp") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/random") + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Library/")) + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/mobile/Library/Preferences") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$") + (subpath "/private/var/mobile/Library/SyncedPreferences") + (subpath "/private/var/mobile/Library/Cookies") + (literal "/private/var/mobile/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/mobile/Library/Logs/PersistentConnection") + (literal "/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc")) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.accountsd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.appleaccount") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb.xml new file mode 100644 index 0000000..9024fd6 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/syncdefaultsd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb new file mode 100644 index 0000000..27472b2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb @@ -0,0 +1,224 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System/Library/Frameworks") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (literal "/dev/null") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.sandbox.executable") + (literal "/dev/random") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Library/Application Support") + (subpath "/private/var/mobile/Library/Inboxes") + (subpath "/private/var/spool/mdt") + (regex #"^/private/var/mobile/Library/Application Support/Containers/" #"^/private/var/mobile/Library/Application Support/Containers$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/transitd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb new file mode 100644 index 0000000..cff0a1f --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb @@ -0,0 +1,262 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$") + (literal "/dev/aes_0") + (literal "/dev/urandom") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/dev/random") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (subpath "/System/Library") + (subpath "/System/Library/PrivateFrameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/null") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/etc/master.passwd") + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/protocols"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/mobile/Library/Preferences") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/mobile") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.aggregated") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfs_helper.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb new file mode 100644 index 0000000..3b23533 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb @@ -0,0 +1,267 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (subpath "/usr/lib") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (literal "/dev/urandom") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/System/Library") + (literal "/dev/null") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (literal "/private/var/run/syslog") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile/Library/Caches") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd$")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com.apple.nsurlsessiond/Downloads/com[.]apple[.]userfsd$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.filesystems.userfs_helper") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/System/Library/Filesystems/msdos.fs/Contents/Resources/fsck_msdos") + (literal "/System/Library/Filesystems/exfat.fs/Contents/Resources/fsck_exfat")))) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb.xml new file mode 100644 index 0000000..5c03ca9 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/userfsd.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb new file mode 100644 index 0000000..127043c --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb @@ -0,0 +1,271 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/private/var/db/timezone") + (subpath "/System/Library/Frameworks") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/ptmx") + (literal "/private/var/mobile/Library/Preferences/com.apple.TelephonyUtilities.plist") + (subpath "/usr/lib") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/mobile/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/dev/null") + (literal "/dev/aes_0") + (subpath "/System/Library") + (literal "/dev/random") + (subpath "/private/var/mobile/Media/Vibrations") + (literal "/dev/urandom") + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/share") + (literal "/private/var/mobile/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/mobile/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/protocols") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (literal "/private/var") + (vnode-type DIRECTORY) + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Preferences") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Media") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/mobile/Media/Vibrations") + (regex #"^/private/var/mobile/Library/Preferences/com[.]apple[.]PeoplePicker[.]plist") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/mobile/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/private/var/mobile/Media") + (literal "/private/var/mobile/Media/Vibrations") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.tccd") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.aggregated") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vibrationmanagerd.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb new file mode 100644 index 0000000..af892f8 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb @@ -0,0 +1,280 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlsessiond.readonly") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.container") + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$")))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$"))))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library/Frameworks") + (literal "/dev/random") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/urandom") + (require-all + (regex #"^/private/var/mobile/Containers/Bundle/VPNPlugin/[-0-9A-Z]+$" #"^/private/var/mobile/Containers/Bundle/VPNPlugin/[-0-9A-Z]+/[^/]+[.]vpnplugin/" #"^/private/var/mobile/Containers/Bundle/VPNPlugin/[-0-9A-Z]+/[^/]+[.]vpnplugin$") + (extension "com.apple.vpn-plugin")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols") + (require-all + (require-not (subpath "/private/var/tmp")) + (require-not (subpath "/private/var/mobile/Library")) + (require-not (subpath "/private/var/logs")) + (require-not (subpath "/private/var/ea")) + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$"))))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$"))) +(allow file-read-metadata + (literal "/private/var/mobile") + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-not (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$"))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-lookup) +(allow mach-register + (global-name-regex #"^com[.]f5[.]f5_sslvpn_plugin")) +(allow network* + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb.xml new file mode 100644 index 0000000..561e3f2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/vpn-plugins.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb new file mode 100644 index 0000000..472d9f5 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb @@ -0,0 +1,243 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (subpath "/AppleInternal") + (literal "/private/var/tmp/webinspectord.log") + (regex #"^/private/var/mobile/Containers/Bundle/[^/]+/[-0-9A-Z]+/") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/dev/null") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/mobile/XcodeBuiltProducts") + (extension "com.apple.sandbox.executable") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/Developer") + (subpath "/usr/share") + (subpath "/System") + (subpath "/Applications") + (subpath "/System/Library/Frameworks") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/mobile/Library/Preferences/com.apple.WebInspector.plist") + (subpath "/System/Library/PrivateFrameworks") + (literal "/private/var/mobile/Library/Preferences/com.apple.webinspectord.plist") + (literal "/dev/random") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-not (require-entitlement "platform-application")) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/hosts") + (literal "/") + (literal "/private/etc/services") + (literal "/private/etc/protocols"))) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal "/private/var/mobile/Library/Caches/powerlog.launchd") + (literal "/private/var/mobile") + (vnode-type SYMLINK) + (literal "/private/var/mobile/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal "/private/var/mobile") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal "/private/var/mobile/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/tmp/webinspectord.log") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.duetknowledged.activity") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.managedconfiguration.profiled.public") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "com.apple.WebInspector") + (preference-domain "com.apple.webinspectord") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb.xml new file mode 100644 index 0000000..08598c2 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/webinspectord.sb.xml @@ -0,0 +1,33 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb new file mode 100644 index 0000000..f8b6800 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb @@ -0,0 +1,216 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper")))) +(allow file-issue-extension + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write"))))) +(allow file-read* + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (subpath "/usr/share/firmware/wifi") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (subpath "/usr/share/zoneinfo.default") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library/Frameworks") + (subpath "/usr/share") + (subpath "/private/var/mobile/Library/ConfigurationProfiles/PublicInfo") + (subpath "/usr/lib") + (literal "/dev/urandom") + (literal "/private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/random") + (subpath "/AppleInternal") + (literal "/dev/ptmx") + (subpath "/System/Library/PrivateFrameworks") + (subpath "/private/var/db/timezone") + (literal "/dev/null") + (subpath "/System/Library") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/mobile/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/private/etc/services") + (literal "/") + (literal "/private/etc/hosts") + (literal "/private/etc/protocols"))) + (require-all + (subpath "/private/var/mobile/XcodeBuiltProducts") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode"))) + (require-all + (subpath "/Developer") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))) +(allow file-read-metadata) +(allow file-write* + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (require-all + (subpath "/private/var/tmp") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode")))))) +(allow file-write-create + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (require-any + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/random")) + (require-any + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))))) +(allow file-write-mode + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (iokit-user-client-class "AppleBCMWLANUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-all + (ipc-posix-name-regex #"^/FSM-" #"^OA-" #"^stack-logs" #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any + (debug-mode) + (require-entitlement "com.apple.private.security.sandbox.debug-mode") + (require-not (require-entitlement "platform-application"))))) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-lookup + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.aggregated") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-not (regex #"/com[.]apple[.]sandbox$" #"/com[.]apple[.]sandbox/" #".+/com[.]apple[.]sandbox$" #".+/com[.]apple[.]sandbox/" #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb.xml b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb.xml new file mode 100644 index 0000000..54501eb --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/rev_profiles/wifiFirmwareLoader.sb.xml @@ -0,0 +1,34 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_ops b/tests/iPad2__1_8.4.1_12H321/references/sb_ops new file mode 100644 index 0000000..688f105 --- /dev/null +++ b/tests/iPad2__1_8.4.1_12H321/references/sb_ops @@ -0,0 +1,114 @@ +default +appleevent-send +authorization-right-obtain +device* +device-camera +device-microphone +distributed-notification-post +file* +file-chroot +file-ioctl +file-issue-extension +file-mknod +file-mount +file-read* +file-read-data +file-read-metadata +file-read-xattr +file-revoke +file-search +file-unmount +file-write* +file-write-create +file-write-data +file-write-flags +file-write-mode +file-write-owner +file-write-setugid +file-write-times +file-write-unlink +file-write-xattr +generic-issue-extension +qtn-user +qtn-download +qtn-sandbox +hid-control +iokit* +iokit-issue-extension +iokit-open +iokit-set-properties +iokit-get-properties +ipc* +ipc-posix* +ipc-posix-issue-extension +ipc-posix-sem +ipc-posix-shm* +ipc-posix-shm-read* +ipc-posix-shm-read-data +ipc-posix-shm-read-metadata +ipc-posix-shm-write* +ipc-posix-shm-write-create +ipc-posix-shm-write-data +ipc-posix-shm-write-unlink +ipc-sysv* +ipc-sysv-msg +ipc-sysv-sem +ipc-sysv-shm +job-creation +load-unsigned-code +lsopen +mach* +mach-bootstrap +mach-issue-extension +mach-lookup +mach-per-user-lookup +mach-priv* +mach-priv-host-port +mach-priv-task-port +mach-register +mach-task-name +network* +network-inbound +network-bind +network-outbound +user-preference* +user-preference-read +user-preference-write +process* +process-exec* +process-exec-interpreter +process-fork +process-info* +process-info-listpids +process-info-pidinfo +process-info-pidfdinfo +process-info-pidfileportinfo +process-info-setcontrol +process-info-dirtycontrol +process-info-rusage +pseudo-tty +signal +sysctl* +sysctl-read +sysctl-write +system* +system-acct +system-audit +system-chud +system-debug +system-fsctl +system-info +system-kext* +system-kext-load +system-kext-unload +system-lcid +system-mac-label +system-nfssvc +system-privilege +system-reboot +system-sched +system-set-time +system-socket +system-suspend-resume +system-swap +system-write-bootstrap diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AdSheet.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AdSheet.sb.bin new file mode 100644 index 0000000..6af241e Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AdSheet.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AirTraffic.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AirTraffic.sb.bin new file mode 100644 index 0000000..6619673 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AirTraffic.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AppleDiags.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AppleDiags.sb.bin new file mode 100644 index 0000000..6b65acd Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/AppleDiags.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Aquarium.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Aquarium.sb.bin new file mode 100644 index 0000000..dcd7229 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Aquarium.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BTServer.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BTServer.sb.bin new file mode 100644 index 0000000..dac432f Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BTServer.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BlueTool.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BlueTool.sb.bin new file mode 100644 index 0000000..8aae06b Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/BlueTool.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CFNetworkAgent.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CFNetworkAgent.sb.bin new file mode 100644 index 0000000..8b9f53f Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CFNetworkAgent.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CVMServer.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CVMServer.sb.bin new file mode 100644 index 0000000..0976f7e Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CVMServer.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CommCenter.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CommCenter.sb.bin new file mode 100644 index 0000000..42e590a Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/CommCenter.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/DataActivation.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/DataActivation.sb.bin new file mode 100644 index 0000000..ac40d7d Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/DataActivation.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/EscrowSecurityAlert.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/EscrowSecurityAlert.sb.bin new file mode 100644 index 0000000..dd490b7 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/EscrowSecurityAlert.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/IMDPersistenceAgent.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/IMDPersistenceAgent.sb.bin new file mode 100644 index 0000000..5d8170a Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/IMDPersistenceAgent.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Lowtide.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Lowtide.sb.bin new file mode 100644 index 0000000..f98ef8a Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Lowtide.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MTLCompilerService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MTLCompilerService.sb.bin new file mode 100644 index 0000000..053fd5f Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MTLCompilerService.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MailCompositionService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MailCompositionService.sb.bin new file mode 100644 index 0000000..744e8be Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MailCompositionService.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileBackup.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileBackup.sb.bin new file mode 100644 index 0000000..8611a23 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileBackup.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileCal.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileCal.sb.bin new file mode 100644 index 0000000..08871df Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileCal.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileMaps.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileMaps.sb.bin new file mode 100644 index 0000000..d5aff93 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileMaps.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSMS.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSMS.sb.bin new file mode 100644 index 0000000..7a039ff Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSMS.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSlideShow.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSlideShow.sb.bin new file mode 100644 index 0000000..9eedc07 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/MobileSlideShow.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/PasteBoard.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/PasteBoard.sb.bin new file mode 100644 index 0000000..ee2920b Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/PasteBoard.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Stocks.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Stocks.sb.bin new file mode 100644 index 0000000..7ed7033 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/Stocks.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/StreamingUnzipService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/StreamingUnzipService.sb.bin new file mode 100644 index 0000000..520cb95 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/StreamingUnzipService.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/WebSheet.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/WebSheet.sb.bin new file mode 100644 index 0000000..f881293 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/WebSheet.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/accessoryd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/accessoryd.sb.bin new file mode 100644 index 0000000..71a62ed Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/accessoryd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/afcd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/afcd.sb.bin new file mode 100644 index 0000000..08dceab Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/afcd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/apsd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/apsd.sb.bin new file mode 100644 index 0000000..be7692e Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/apsd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cloudphotod.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cloudphotod.sb.bin new file mode 100644 index 0000000..7ed9ade Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cloudphotod.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.AssetCacheLocatorService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.AssetCacheLocatorService.sb.bin new file mode 100644 index 0000000..79d096a Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.AssetCacheLocatorService.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.GSSCred.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.GSSCred.sb.bin new file mode 100644 index 0000000..434f37a Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.GSSCred.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Databases.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Databases.sb.bin new file mode 100644 index 0000000..0356567 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Databases.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Networking.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Networking.sb.bin new file mode 100644 index 0000000..5101ea3 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.Networking.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.WebContent.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.WebContent.sb.bin new file mode 100644 index 0000000..3474e6a Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.WebKit.WebContent.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.assistant.assistantd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.assistant.assistantd.sb.bin new file mode 100644 index 0000000..7cd06c1 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.assistant.assistantd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.bird.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.bird.sb.bin new file mode 100644 index 0000000..d8ae405 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.bird.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.cloudd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.cloudd.sb.bin new file mode 100644 index 0000000..b364154 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.cloudd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.datadetectors.AddToRecentsService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.datadetectors.AddToRecentsService.sb.bin new file mode 100644 index 0000000..85fe3e1 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.datadetectors.AddToRecentsService.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.discoveryd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.discoveryd.sb.bin new file mode 100644 index 0000000..ca7b032 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.discoveryd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.homed.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.homed.sb.bin new file mode 100644 index 0000000..001a6fa Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.homed.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nehelper.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nehelper.sb.bin new file mode 100644 index 0000000..7bdb703 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nehelper.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nesessionmanager.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nesessionmanager.sb.bin new file mode 100644 index 0000000..25bdde6 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.nesessionmanager.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.quicklook.QLThumbnailsService.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.quicklook.QLThumbnailsService.sb.bin new file mode 100644 index 0000000..9a9f31e Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.quicklook.QLThumbnailsService.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.rtcreportingd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.rtcreportingd.sb.bin new file mode 100644 index 0000000..ebe9222 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.rtcreportingd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.sandboxd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.sandboxd.sb.bin new file mode 100644 index 0000000..4cc7844 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.sandboxd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.snhelper.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.snhelper.sb.bin new file mode 100644 index 0000000..e469b12 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.snhelper.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tccd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tccd.sb.bin new file mode 100644 index 0000000..307dab2 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tccd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tzlinkd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tzlinkd.sb.bin new file mode 100644 index 0000000..771bb75 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.tzlinkd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.ubd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.ubd.sb.bin new file mode 100644 index 0000000..2f78641 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.ubd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.xpcd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.xpcd.sb.bin new file mode 100644 index 0000000..925d75d Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/com.apple.xpcd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/container.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/container.sb.bin new file mode 100644 index 0000000..d008025 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/container.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/coresymbolicationd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/coresymbolicationd.sb.bin new file mode 100644 index 0000000..fb5f74d Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/coresymbolicationd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cplogd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cplogd.sb.bin new file mode 100644 index 0000000..4664089 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/cplogd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/dataaccessd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/dataaccessd.sb.bin new file mode 100644 index 0000000..2aa2f91 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/dataaccessd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/debugserver.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/debugserver.sb.bin new file mode 100644 index 0000000..54ed39d Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/debugserver.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/deleted.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/deleted.sb.bin new file mode 100644 index 0000000..ff8fefe Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/deleted.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/fmfd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/fmfd.sb.bin new file mode 100644 index 0000000..44828c4 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/fmfd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ftp-proxy-embedded.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ftp-proxy-embedded.sb.bin new file mode 100644 index 0000000..cb1c823 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ftp-proxy-embedded.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gamed.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gamed.sb.bin new file mode 100644 index 0000000..32cf36e Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gamed.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geocorrectiond.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geocorrectiond.sb.bin new file mode 100644 index 0000000..7ed9ade Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geocorrectiond.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geod.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geod.sb.bin new file mode 100644 index 0000000..45e2f95 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/geod.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gizmoappd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gizmoappd.sb.bin new file mode 100644 index 0000000..df35afc Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gizmoappd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gputoolsd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gputoolsd.sb.bin new file mode 100644 index 0000000..55ed3df Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/gputoolsd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/healthd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/healthd.sb.bin new file mode 100644 index 0000000..ab812c2 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/healthd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/iapd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/iapd.sb.bin new file mode 100644 index 0000000..337faf6 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/iapd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/keyboard.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/keyboard.sb.bin new file mode 100644 index 0000000..efb0170 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/keyboard.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/librariand.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/librariand.sb.bin new file mode 100644 index 0000000..e4bd9d5 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/librariand.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/limitadtrackingd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/limitadtrackingd.sb.bin new file mode 100644 index 0000000..08711e8 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/limitadtrackingd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/lockdownd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/lockdownd.sb.bin new file mode 100644 index 0000000..7d0dfeb Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/lockdownd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mDNSResponder.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mDNSResponder.sb.bin new file mode 100644 index 0000000..58b8db0 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mDNSResponder.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mediaserverd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mediaserverd.sb.bin new file mode 100644 index 0000000..44f6197 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mediaserverd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mobile-house-arrest.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mobile-house-arrest.sb.bin new file mode 100644 index 0000000..13037f4 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mobile-house-arrest.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mobileassetd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mobileassetd.sb.bin new file mode 100644 index 0000000..7545440 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/mobileassetd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomaild.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomaild.sb.bin new file mode 100644 index 0000000..f89d4eb Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomaild.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapscd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapscd.sb.bin new file mode 100644 index 0000000..764292d Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapscd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapsgd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapsgd.sb.bin new file mode 100644 index 0000000..c9557e3 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nanomapsgd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nfcd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nfcd.sb.bin new file mode 100644 index 0000000..d8b616b Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nfcd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nlcd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nlcd.sb.bin new file mode 100644 index 0000000..9fa7820 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nlcd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nointernet.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nointernet.sb.bin new file mode 100644 index 0000000..59ca3c5 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nointernet.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlsessiond.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlsessiond.sb.bin new file mode 100644 index 0000000..182d0dd Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlsessiond.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlstoraged.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlstoraged.sb.bin new file mode 100644 index 0000000..8d666a6 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/nsurlstoraged.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/passd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/passd.sb.bin new file mode 100644 index 0000000..15b834d Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/passd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/pfd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/pfd.sb.bin new file mode 100644 index 0000000..333abce Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/pfd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/printd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/printd.sb.bin new file mode 100644 index 0000000..65d4c96 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/printd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ptpd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ptpd.sb.bin new file mode 100644 index 0000000..4a0f536 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/ptpd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/quicklookd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/quicklookd.sb.bin new file mode 100644 index 0000000..1cc7f8c Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/quicklookd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/racoon.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/racoon.sb.bin new file mode 100644 index 0000000..5a29bf4 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/racoon.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/reversetemplated.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/reversetemplated.sb.bin new file mode 100644 index 0000000..4ee4e8d Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/reversetemplated.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/revisiond.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/revisiond.sb.bin new file mode 100644 index 0000000..5cd3113 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/revisiond.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/routined.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/routined.sb.bin new file mode 100644 index 0000000..1c0a523 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/routined.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/seld.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/seld.sb.bin new file mode 100644 index 0000000..e9283e3 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/seld.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/sharingd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/sharingd.sb.bin new file mode 100644 index 0000000..7ed9ade Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/sharingd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/softwareupdated.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/softwareupdated.sb.bin new file mode 100644 index 0000000..8f667e5 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/softwareupdated.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/streaming_zip_conduit.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/streaming_zip_conduit.sb.bin new file mode 100644 index 0000000..f9fba88 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/streaming_zip_conduit.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/suggestd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/suggestd.sb.bin new file mode 100644 index 0000000..21092ac Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/suggestd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/syncdefaultsd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/syncdefaultsd.sb.bin new file mode 100644 index 0000000..82db3c6 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/syncdefaultsd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/transitd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/transitd.sb.bin new file mode 100644 index 0000000..d12062f Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/transitd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/userfs_helper.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/userfs_helper.sb.bin new file mode 100644 index 0000000..0f731b8 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/userfs_helper.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/userfsd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/userfsd.sb.bin new file mode 100644 index 0000000..efcce67 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/userfsd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/vibrationmanagerd.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/vibrationmanagerd.sb.bin new file mode 100644 index 0000000..b5754e6 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/vibrationmanagerd.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/vpn-plugins.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/vpn-plugins.sb.bin new file mode 100644 index 0000000..fba1275 Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/vpn-plugins.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/webinspectord.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/webinspectord.sb.bin new file mode 100644 index 0000000..5c0a95f Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/webinspectord.sb.bin differ diff --git a/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/wifiFirmwareLoader.sb.bin b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/wifiFirmwareLoader.sb.bin new file mode 100644 index 0000000..0bb125e Binary files /dev/null and b/tests/iPad2__1_8.4.1_12H321/references/sb_profiles/wifiFirmwareLoader.sb.bin differ diff --git a/tests/iPhone5__1_9.3_13E237/inputs/sandbox.kext b/tests/iPhone5__1_9.3_13E237/inputs/sandbox.kext new file mode 100644 index 0000000..fb07cbe Binary files /dev/null and b/tests/iPhone5__1_9.3_13E237/inputs/sandbox.kext differ diff --git a/tests/iPhone5__1_9.3_13E237/logs/.dummy b/tests/iPhone5__1_9.3_13E237/logs/.dummy new file mode 100644 index 0000000..e69de29 diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb new file mode 100644 index 0000000..f69fc1d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb @@ -0,0 +1,386 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^stack-logs") + (ipc-posix-name-regex #"^OA-") + (ipc-posix-name-regex #"^/FSM-")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/syslog"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal + (target self)) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AGXCompilerService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb new file mode 100644 index 0000000..5637d93 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb @@ -0,0 +1,1508 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read"))) +(allow file-link + (require-all + (require-not (subpath-prefix "${HOME}/Library/AddressBook")) + (require-any + (require-not (subpath-prefix "${HOME}/Media")) + (require-entitlement "platform-application")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdSheetPad.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSMS.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/SpringBoard") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdSheetPhone.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.adtracking.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") + (literal-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.reminders.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/.+$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPhone/(?|.+)$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetP(ad|hone)/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]AdSheet(Pad|Phone).plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath "/Library/Ringtones") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Media/Purchases") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPad[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPad-.+[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]AdSheetPhone-.*[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]AdSheetP(ad|hone)-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]AdSheetP(ad|hone)[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]AdSheetP(ad|hone)[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage") + (literal "/private/var/run/syslog") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}/Library/Caches/Snapshots") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Saved Application State") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdSheetPad.plist") + (literal-prefix "${HOME}/Library/SpringBoard") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdSheetPhone.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iad") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.reminders.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]AdSheet(Pad|Phone).plist") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetPhone$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AdSheetP(ad|hone)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPad/.+$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetPhone/(?|.+)$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]AdSheetP(ad|hone)/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPad[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]AdSheetPhone[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]AdSheetP(ad|hone)[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]AdSheetP(ad|hone)[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPad[.]savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]AdSheetPhone[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]AdSheetP(ad|hone)[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")))))))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]") + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.chatkit.clientcomposeserver.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobilemail") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "ScripterServer") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "PurplePPTServer") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.lsd.openurl") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.lsd") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.calaccessd") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.GSSCred") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.passd.assertions") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.fig.movie") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name-regex #"^com[.]apple[.]iad[.]") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.xpcd") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.webinspector") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nehelper") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.TextInput") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobile.deleted") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.aggregated") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.mobilemail.messageuiservices") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.bird.token") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.eventpump") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.ait.client") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.cvmsServ") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.cache_delete") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.dataaccess.dataaccessd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.revisiond") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.companion.camera") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.passd.in-app-payment") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.webfilterd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.dataaccess.dataaccessd.active") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.passd.library") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.coremedia.cameraviewfinder") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "com.apple.imagent.Embedded.Launched") + (global-name "com.apple.bird") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (literal "/private/var/run/printd") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CoreMotion") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.reminders") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.AdSheetPad") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.AdSheetPhone") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.reminders") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AdSheetPad") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.AdSheetPhone") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 32))) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AdSheet.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb new file mode 100644 index 0000000..cab1d10 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb @@ -0,0 +1,135 @@ +(version 1) +(allow default) +(deny file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")))) +(deny file-mount) +(deny file-mount-update) +(deny file-read* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-not (subpath "/Developer")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-only")) + (require-not (extension "com.apple.sandbox.executable")) + (require-not (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist")) + (require-not (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$")) + (require-not (subpath "/System/Library")) + (require-not (subpath "/usr/lib")) + (require-not (subpath "/usr/share")) + (require-not (subpath "/private/var/db/timezone")) + (require-any + (literal "/private/etc/master.passwd") + (literal "/private/var") + (literal "/private/var/root") + (require-all + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist")) + (require-not (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$")) + (require-not (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+")) + (require-not (subpath "/private/var/tmp")) + (require-not (literal "/private/var/preferences/com.apple.security.plist")) + (require-not (literal "/private/var/preferences/com.apple.NetworkStatistics.plist")) + (require-not (literal "/private/var/preferences/com.apple.networkd.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist")) + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/dtracehelper")) + (require-not (literal "/dev/null")) + (require-not (literal "/dev/zero")) + (require-any + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")) + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))))))))) +(deny file-unmount) +(deny file-write* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-any + (literal "/private/etc/master.passwd") + (literal "/private/var") + (literal "/private/var/root") + (require-all + (require-not (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+")) + (require-not (subpath "/private/var/tmp")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal")) + (require-any + (require-not (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal")) + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-not (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")))))))) +(deny file-write-create + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) +(deny file-write-data + (require-all + (require-not (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any + (literal "/dev/random") + (literal "/dev/urandom")))) +(deny job-creation) +(deny network-outbound + (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb.xml new file mode 100644 index 0000000..04fe0db --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/AirTraffic.sb.xml @@ -0,0 +1,24 @@ + + + + + + + + + +]> + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb new file mode 100644 index 0000000..2af0a63 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb @@ -0,0 +1,654 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/uart.log") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Library/AddressBook"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.BTServer.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (subpath "/private/var/wireless/Library/Logs/awd") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.debug.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.services.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.devices.plist") + (subpath-prefix "${HOME}/Library/Logs/Bluetooth") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.ledevices.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/Developer") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") + (literal "/private/var/wireless/Library/CallHistory") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath-prefix "${HOME}/Library/MobileBluetooth") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.BTServer.airplane.plist") + (literal "/dev/uart.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Application Support/BTServer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.TelephonyUtilities.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-data + (literal "/dev/btwake") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/System") + (literal "/usr/sbin/BTServer") + (literal "/usr/sbin") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist")) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/wireless") + (literal "/usr/sbin/BTServer") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/usr/sbin") + (literal "/private/var") + (literal "/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/wireless/Library") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") + (subpath-prefix "${HOME}/Library/MobileBluetooth") + (literal "/Library/Application Support/BTServer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.devices.plist") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") + (literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") + (subpath-prefix "${HOME}/Library/Logs/Bluetooth") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.BTServer.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/hci") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/wireless/Library/CallHistory") + (subpath "/private/var/wireless/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.services.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.debug.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileBluetooth.ledevices.plist") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.BTServer.airplane.plist") + (require-all + (vnode-type DIRECTORY) + (literal "/Library/Application Support/BTServer")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/wireless/Library/CallHistory"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/uart.log") + (literal "/Library/Application Support/BTServer/pincode_defaults.db") + (literal "/private/var/wireless/Library/CallHistory/call_history.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOUserEthernetResourceUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^stack-logs") + (ipc-posix-name-regex #"^OA-") + (ipc-posix-name "shm_notif.tacl.R") + (ipc-posix-name "shm_pcm_audio_sco_write") + (ipc-posix-name-regex #"^..:..:..:..:..:..-tacl$") + (ipc-posix-name "shm_notif.tacl.W") + (ipc-posix-name "shm_notif.tsco.R") + (ipc-posix-name "shm_pcm_audio_sco_read") + (ipc-posix-name "shm_notif.tsco.W") + (ipc-posix-name-regex #"^/FSM-") + (ipc-posix-name "com.apple.BTServer.magnet.shm")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.BlueTool") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.marco") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.springboard.services") + (global-name "com.apple.BTServer.avrcp") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.BTServer.map") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.BTAudioHALPlugin.xpc") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.networkd") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.carkit.service") + (global-name "com.apple.system.logger") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.BTServer.pbap") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.MobileBluetooth.debug") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.MobileBluetooth.ledevices") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.BTServer.airplane") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.BTServer") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.MobileBluetooth.devices") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.MobileBluetooth.services") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.BTServer.airplane") + (preference-domain "com.apple.MobileBluetooth.devices") + (preference-domain "com.apple.MobileBluetooth.ledevices") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.BTServer") + (preference-domain "com.apple.MobileBluetooth.debug") + (preference-domain "com.apple.MobileBluetooth.services")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb.xml new file mode 100644 index 0000000..ab808c0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BTServer.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb new file mode 100644 index 0000000..bdae965 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb @@ -0,0 +1,399 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (literal "/dev/ptmx") + (literal "/usr/sbin") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/etc/bluetool") + (subpath "/AppleInternal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-data + (literal "/dev/btreset") + (literal "/dev/btwake")) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleBasebandUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/BlueTool.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb new file mode 100644 index 0000000..c93080c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb @@ -0,0 +1,173 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CFNetworkAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb new file mode 100644 index 0000000..9b1f6ff --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb @@ -0,0 +1,235 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/usr/bin/codesign_allocate") + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name-regex #"^com[.]apple[.]cvmsCompAgent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (subpath "/System/Library/Frameworks/OpenGLES.framework") + (subpath "/usr/bin/codesign_allocate")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CVMServer.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb new file mode 100644 index 0000000..5131a44 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb @@ -0,0 +1,436 @@ +(version 1) +(deny default) +(allow file-ioctl + (subpath "/private/var/wireless") + (regex #"^/dev/dlci[.]spi-baseband[.]") + (regex #"^/dev/bbcdc[.]") + (literal "/dev/uart.debug.log") + (literal "/dev/uart.umts") + (literal "/dev/cu.debug") + (literal "/dev/ptmx") + (literal "/dev/uart.debug") + (literal "/dev/mux.log") + (literal "/dev/mux.spi-baseband") + (literal "/dev/uart.log") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/wireless/Library/Caches/com.apple.coretelephony") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath "/private/var/wireless/Library/Caches/CommCenterClassic") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSMS.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath-prefix "${FRONT_USER_HOME}/Library/LASD") + (regex #"^/dev/bbcdc[.]") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/mux.spi-baseband") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/dev/dlci[.]spi-baseband[.]") + (literal "/dev/uart.debug") + (literal-prefix "${FRONT_USER_HOME}/Library/SyncedPreferences/com.apple.coretelephony.plist") + (literal "/dev/ptmx") + (literal "/dev/cu.debug") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.apsalerts.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.operator.plist") + (literal "/dev/uart.debug.log") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.tethering_override.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videoconference_override.plist") + (regex #"^/private/var/tmp/CSI[.]scratch") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/preferences/AeneasCustomFlags.plist") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/dev/uart.umts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cellulardataplan.plist") + (literal "/dev/mux.log") + (literal "/dev/uart.log") + (literal "/dev/dtracehelper") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal "/dev") + (literal "/dev/random") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iqagent.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]coretelephony" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]coretelephony" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]coretelephony") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-not (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist-lock") + (literal "/private/var/CommCenter/spool/loading") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/uart.log") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/private/var/logs/WirelessLibraryLogs") + (literal "/dev/mux.log") + (regex #"^/dev/bbcdc[.]") + (regex #"^/private/var/logs/CoreTelephonyTrace$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-.+$") + (literal "/dev/cu.debug") + (regex #"^/private/var/tmp/CSI[.]scratch") + (literal "/private/var/logs/CoreTelephonyTraceScratch") + (regex #"^/private/var/preferences/csidata$" #"^/private/var/preferences/csidata[.]tmp$") + (literal "/private/var/logs/log-bb-live-stats.txt") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal "/private/var/preferences/AeneasCustomFlags.plist") + (literal "/dev/mux.spi-baseband") + (literal "/dev/uart.umts") + (literal "/dev/uart.debug.log") + (regex #"^/dev/dlci[.]spi-baseband[.]") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/wireless") + (literal "/dev/uart.debug") + (regex #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist$" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist-lock$" #"^/private/var/preferences/SystemConfiguration/OSThermalStatus[.]plist-new$") + (subpath "/private/var/tmp") + (regex #"^/private/var/logs/CrashReporter/Baseband/log-bb-$" #"^/private/var/logs/CrashReporter/Baseband/log-bb-.+$") + (subpath-prefix "${FRONT_USER_HOME}/Library/LASD") + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]coretelephony" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]coretelephony" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]coretelephony") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist")) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.apple.CommCenter.lasd") + (global-name-regex #"^com[.]apple[.]CoreTelephony[.]LogChannel[.]$" #"^com[.]apple[.]CoreTelephony[.]LogChannel[.][-0-9A-F]+$") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.apsalerts") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.operator") + (preference-domain "com.apple.tethering_override") + (preference-domain "com.apple.carrier") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.videoconference_override") + (preference-domain "com.apple.commcenter") + (preference-domain "com.apple.cellulardataplan") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb.xml new file mode 100644 index 0000000..f81f602 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/CommCenter.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb new file mode 100644 index 0000000..377d218 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb @@ -0,0 +1,860 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/WebClips") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Media")) + (require-entitlement "platform-application")) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtube.dp.plist") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal-prefix "${HOME}/Library/Preferences/.dat") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Dictionaries") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/AppleInternal/Library/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataActivation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath-prefix "${HOME}/Library/Dictionaries") + (subpath-prefix "${HOME}/Library/Caches/Safari") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]DataActivation.plist") + (subpath "/Applications/DataActivation.app") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilesafari.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/Library/Ringtones") + (subpath-prefix "${HOME}/Library/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/Applications/MobileSafari.app") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath "/usr/share") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (extension "com.apple.app-sandbox.read") + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]DataActivation[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]DataActivation[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]DataActivation-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]DataActivation-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilemail.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.OTASyncAgent.plist")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/WebKit") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Safari") + (literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilesafari.plist") + (literal-prefix "${HOME}/Library/Preferences/.dat") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtube.dp.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (subpath-prefix "${HOME}/Library/Caches/Safari") + (subpath "/private/var/tmp/MediaCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataActivation.plist") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]DataActivation.plist") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Mail/AutoFetchEnabled")) + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]DataActivation[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]DataActivation[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]DataActivation[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]DataActivation$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]DataActivation[.]savedState") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/asl_input") + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (literal "/private/var/run/printd") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.DataActivation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.youtube.dp") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mobilecal") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataActivation") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtube.dp") + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-exec* + (literal "/Applications/MobileSafari.app/MobileSafari") + (literal "/Applications/DataActivation.app/DataActivation")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb.xml new file mode 100644 index 0000000..31b4e67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/DataActivation.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb new file mode 100644 index 0000000..2e35458 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb @@ -0,0 +1,238 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/EscrowSecurityAlert.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb new file mode 100644 index 0000000..973cfd1 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb @@ -0,0 +1,305 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.IDSCredentialsAgent.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.IDSCredentialsAgent.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.ids.IDSCredentialsAgent") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ids.IDSCredentialsAgent")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSCredentialsAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..237fc87 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb @@ -0,0 +1,495 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.idsfoundation.IDSRemoteURLConnectionAgent.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.idsfoundation.IDSRemoteURLConnectionAgent.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]idsfoundation[.]IDSRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.apsd") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.facetime.bag") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.imessage.bag") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (preference-domain "com.apple.imessage.bag")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb new file mode 100644 index 0000000..f018d1e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb @@ -0,0 +1,305 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${HOME}/Library/PPTDevice") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imdsmsrecordstore.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/SMSMigrator") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/SMSMigrator") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imdsmsrecordstore.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/SMS") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.open") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.search.appindexer") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.searchd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.message") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMDPersistenceAgent.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..8f38c47 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb @@ -0,0 +1,493 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imfoundation.IMRemoteURLConnectionAgent.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/IMRemoteURLConnectionAgent") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imfoundation.IMRemoteURLConnectionAgent.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/IMRemoteURLConnectionAgent") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]imfoundation[.]IMRemoteURLConnectionAgent$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.apsd") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.awdd") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb new file mode 100644 index 0000000..b1c4ca7 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb @@ -0,0 +1,617 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath "/private/var/tmp") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSMS.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imtranscoding.IMTranscoderAgent.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mms_override.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Media") + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imtranscoding.IMTranscoderAgent.plist") + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.pegasus") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.marco") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/IMTranscoderAgent.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb new file mode 100644 index 0000000..d4b30c5 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb @@ -0,0 +1,1260 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/AppleTV")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/AppleTV") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/Applications") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.apsd.launchd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.storebookkeeper.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath-prefix "${HOME}/Library/MediaStream") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.celestial.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${HOME}/Library/Logs") + (subpath-prefix "${HOME}/Library/Application Support/Front Row") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Updates") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CrashReporter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-shm") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appletvservices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath-prefix "${HOME}/Media/Radio") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-journal") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences-sounds.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.soundpref.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Radio") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iqagent.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Documents/var/nrd") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/Ubiquity") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.datetime.plist") + (subpath "/private/var/logs/CrashReporter") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.frontrow.") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.LaunchServices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-AppleTV.log") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (subpath "/AppleInternal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (subpath-prefix "${HOME}/Library/Caches/AppleTV") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-wal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/iTunes_Control") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]lowtide.plist") + (subpath "/private/var/MobileSoftwareUpdate") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]lowtide[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]lowtide-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]lowtide-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/.+$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]lowtide") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]lowtide[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Radio") + (subpath-prefix "${HOME}/Media/Radio") + (literal "/private/var/db/timezone/localtime") + (literal-prefix "${HOME}/Library/Preferences/com.apple.apsd.launchd") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (subpath-prefix "${HOME}/Library/MediaStream") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/private/var/tmp/MediaControlServer.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.datetime.plist") + (literal-prefix "${HOME}/Library/Logs") + (subpath "/private/var/tmp/AirTunes") + (subpath-prefix "${HOME}/Library/Application Support/Front Row") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.storebookkeeper.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-shm") + (subpath-prefix "${HOME}/Library/Logs/Ubiquity") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appletvservices.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences-sounds.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.soundpref.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iqagent.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Documents/var/nrd") + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.celestial.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal "/Library/Application Support/Front Row") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb") + (literal-prefix "${HOME}/Library/Preferences/com.apple.frontrow.") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iLifeSlideshow") + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb-wal") + (literal-prefix "${HOME}/Library/Logs/awd/awd-AppleTV.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (subpath-prefix "${HOME}/Library/Caches/AppleTV") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CrashReporter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath "/private/var/MobileSoftwareUpdate") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]lowtide.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/.+$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]lowtide/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]lowtide" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]lowtide") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]lowtide[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]lowtide[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]lowtide[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]lowtide$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]lowtide$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies")))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (literal-prefix "${HOME}/Documents") + (literal-prefix "${HOME}/Documents/var") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]lowtide[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Logs/ADDataStore.sqlitedb") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-flags + (literal-prefix "${HOME}/Media")) +(allow file-write-mode + (literal-prefix "${HOME}/Media") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Updates") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAVAudioInterfaceUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IODPDisplayInterfaceUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAVControllerUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IODPDeviceUserClient") + (iokit-user-client-class "IOAVServiceUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IODPAudioInterfaceUserClient") + (iokit-user-client-class "ASPUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAVDeviceUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IODPServiceUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAVVideoInterfaceUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IODPControllerUserClient") + (iokit-user-client-class "AppleNANDFTLUserClient")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.absinthed") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.formatreaderloader") + (global-name "com.apple.atvitunescloudd.xpc") + (global-name "ScripterServer") + (global-name "com.apple.absd") + (global-name "com.apple.backboard.checkin") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.trustd") + (global-name "com.apple.coremedia.wirelessdisplay") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "PurplePPTServer") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.coremedia.formatreader") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.uikit.GestureServer") + (local-name "com.apple.coremedia.customurlhandler") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.frontrow.tracerouteix") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videoqueue") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.CrashCopy.OTA") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.backboard.workspaceserverconnection") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.apsd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.networkd") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.fairplayd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.adid") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.bird.token") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.backboard.system-app-server") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.tzlink") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.cpe") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.backboard.applicationdatastore.service") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.securityd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.webinspector") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.aggregated.addaily") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.mobile.softwareupdated") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.marco") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.corercd") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.SBUserNotification") + (local-name "com.apple.accessibility.gax.client") + (global-name "com.apple.airplay.xpc") + (global-name "com.apple.frontboard.watchdogserver") + (global-name "PurpleSystemAppPort") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name-regex #"^com[.]apple[.]appletv$" #"^com[.]apple[.]appletv[.]" #"^com[.]apple[.]lowtide$" #"^com[.]apple[.]lowtide[.]") + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow mach-task-name) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/tmp/hidmonitordsocket") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (literal "/private/var/run/mDNSResponder") + (remote tcp "*:*") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.soundpref") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.appletvservices") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.voiceservices") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.storebookkeeper") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.soundpref") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.appletvservices") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.storebookkeeper") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.itunesstored") + (preference-domain "kCFPreferencesAnyApplication")) +(allow process-exec* + (subpath "/Applications/AppleTV.app")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb.xml new file mode 100644 index 0000000..c27b781 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/Lowtide.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb new file mode 100644 index 0000000..671670c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb @@ -0,0 +1,186 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MTLCompilerService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb new file mode 100644 index 0000000..3ca0de6 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb @@ -0,0 +1,1171 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/WebKit") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]MailCompositionService.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/AppleInternal/Library/Frameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (subpath-prefix "${HOME}/Media/Safari") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mail.composition.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/Library/Ringtones") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilemail.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (extension "com.apple.app-sandbox.read") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]MailCompositionService[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MailCompositionService[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]MailCompositionService-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]MailCompositionService-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/FairPlay") + (literal "/usr/sbin/fairplayd") + (subpath-prefix "${HOME}/Media") + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mail.composition.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]MailCompositionService.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]MailCompositionService[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]MailCompositionService[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]MailCompositionService[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MailCompositionService$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]MailCompositionService[.]savedState") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.suggestd.suggestionmanager") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]dataaccess[.]dataaccessd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.imagent.embedded.auth") + (global-name "ScripterServer") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.xpcd") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.webfilterd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.itunescloudd.xpc") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.webinspector") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.aggregated") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.TextInput.shortcuts") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.coreduetd") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.securityd") + (global-name "com.apple.voiceservices.keepalive") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.GSSCred") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.bulletinboard.utilitiesconnection") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/printd") + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CoreMotion") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.message") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb.xml new file mode 100644 index 0000000..c3c699a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MailCompositionService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb new file mode 100644 index 0000000..5d50517 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb @@ -0,0 +1,9 @@ +(version 1) +(allow default) +(deny file-read* + (subpath "/private/var/run/mobile_image_mounter")) +(deny file-write-unlink + (literal "/private") + (literal "/private/var") + (literal "/private/var/run")) +(deny job-creation) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb.xml new file mode 100644 index 0000000..c2485d3 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileBackup.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb new file mode 100644 index 0000000..41ba880 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb @@ -0,0 +1,875 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.TelephonyUtilities.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/AppleInternal/Library/Frameworks") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.calendardiagnostics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.timezones.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Logs/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.eventkit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (subpath-prefix "${HOME}/Library/Logs/Handoff") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (subpath "/private/var/tmp") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]mobilecal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/Library/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]mobilecal[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobilecal[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobilecal-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]mobilecal-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/FairPlay") + (literal "/usr/sbin/fairplayd") + (subpath-prefix "${HOME}/Media") + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}"))))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.timezones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.plist") + (subpath-prefix "${HOME}/Library/Logs/Handoff") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.calendardiagnostics.plist") + (subpath-prefix "${HOME}/Library/Logs/Calendar") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath "/private/var/tmp") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]mobilecal.plist") + (extension "com.apple.app-sandbox.read-write") + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobilecal[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]mobilecal[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]mobilecal[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobilecal$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mobilecal$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]mobilecal[.]savedState") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.mobilecal.timezones") + (preference-domain "com.apple.calendardiagnostics") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.eventkit") + (preference-domain "com.apple.message") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.SpeakSelection") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.mobilecal") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.calendardiagnostics") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mobilecal.timezones") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb.xml new file mode 100644 index 0000000..31b4e67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileCal.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb new file mode 100644 index 0000000..9551d3a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb @@ -0,0 +1,970 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath-prefix "${HOME}/Library/Maps") + (subpath-prefix "${HOME}/Library/Caches/Maps") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Maps.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weather.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.internal.Voltaire.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mms_override.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath "/AppleInternal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.skyhookwireless.wps.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath "/Applications/Maps.app") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]Maps.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/Library/Ringtones") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]Maps[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]Maps-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]Maps-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]Maps[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/.+$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]Maps[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]Maps") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-data + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (subpath-prefix "${HOME}/Library/Maps") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.internal.Voltaire.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.skyhookwireless.wps.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Maps.plist") + (subpath-prefix "${HOME}/Library/Caches/Maps") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]Maps.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]Maps[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]Maps[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]Maps[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/$" #"^/private/var/mobile/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/.+$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.iTunesStore/ISURLBag/com[.]apple[.]Maps/(?|.+)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]Maps[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]Maps$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]Maps" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]Maps") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]Maps[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]Maps[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.internal.Voltaire") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.mobileipod") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.voiceservices") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.Maps") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.skyhookwireless.wps") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Maps") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.internal.Voltaire") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.skyhookwireless.wps") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.itunesstored")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket + (socket-domain 39) + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb.xml new file mode 100644 index 0000000..31b4e67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileMaps.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb new file mode 100644 index 0000000..b21aeb1 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb @@ -0,0 +1,1154 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath "/private/var/tmp")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath "/private/var/tmp")) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos"))))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.legacycamera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.act.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath "/usr/lib") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanocamera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cloud.quota.plist") + (subpath-prefix "${HOME}/Library/SMS") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videouploadplugins.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSMS.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (subpath-prefix "${HOME}/Library/Siri") + (literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilemail.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.notbackedup.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (literal-prefix "${HOME}/Library/SpringBoard") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaanalysis.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mms_override.plist") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.compass.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (subpath "/Library/Dictionaries") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath "/Library/Ringtones") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.](mobileslideshow|camera).plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Media/Purchases") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$" #"^/private/var/euser[0-9]+/Containers/.*$")) + (require-not (subpath "/private/var/containers")) + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/euser[0-9]+/Library/"))) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow[.]savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.](mobileslideshow|camera)[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.](mobileslideshow|camera)[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.](mobileslideshow|camera)[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobileslideshow[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]mobileslideshow-.+[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]camera-.*[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.](mobileslideshow|camera)-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")))))) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") + (literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/SpringBoard") + (literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log") + (literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") + (subpath-prefix "${HOME}/Library/Siri") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") + (subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") + (subpath-prefix "${HOME}/Library/SMS") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") + (subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]") + (subpath-prefix "${HOME}")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobileipod.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanocamera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videouploadplugins.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.legacycamera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.notbackedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cloud.quota.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.](mobileslideshow|camera).plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow[.]savedState/" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.](mobileslideshow|camera)[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]mobileslideshow[.]settings/" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]camera[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.](mobileslideshow|camera)[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.](mobileslideshow|camera)[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]mobileslideshow$" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]camera$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.](mobileslideshow|camera)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]mobileslideshow[.]savedState" #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]camera[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.](mobileslideshow|camera)[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Siri")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")))) +(allow file-write-data + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (subpath "/private/var/mnt") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.da") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.InputModePreferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videouploadplugins") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.youtubeframework") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.act") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.accountsd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.cloud.quota") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.youtubeframework.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.legacycamera") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanocamera") + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.legacycamera") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.videouploadplugins") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.nanocamera") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.youtubeframework.notbackedup") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.cloud.quota")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb.xml new file mode 100644 index 0000000..5885e3b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/MobileSlideShow.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb new file mode 100644 index 0000000..4054433 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb @@ -0,0 +1,178 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (require-not (literal "/dev/random")) + (subpath "/Developer") + (require-not (literal "/dev/urandom")) + (require-not (literal "/dev/ptmx")) + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/")) + (subpath "/System/Library") + (require-not (literal "/dev/aes_0")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard") + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-not (literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-not (literal "/dev/zero")) + (subpath "/usr/lib") + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/usr/share") + (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-not (literal "/dev/dtracehelper")) + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")) + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (require-not (extension "com.apple.sandbox.pty"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (require-not (subpath-prefix "${FRONT_USER_HOME}"))) + (require-all + (vnode-type TTY) + (require-not (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/System/Library/Frameworks/UIKit.framework/Support/pasteboardd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb.xml new file mode 100644 index 0000000..4162129 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/PasteBoard.sb.xml @@ -0,0 +1,51 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb new file mode 100644 index 0000000..877e74e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb @@ -0,0 +1,192 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (literal "/private/var/db/icu") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath "/System") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/SafariSafeBrowsing.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb new file mode 100644 index 0000000..b7c8ef3 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb @@ -0,0 +1,195 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ScreenshotService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb new file mode 100644 index 0000000..bfcb108 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb @@ -0,0 +1,201 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.StreamingUnzipService.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.StreamingUnzipService") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.StreamingUnzipService.plist") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.StreamingUnzipService") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.StreamingUnzipService")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/StreamingUnzipService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb new file mode 100644 index 0000000..b27ec1b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb @@ -0,0 +1,1118 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobilemail.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.accountsettings.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.accountsettings.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.OTASyncAgent.plist$")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebSheet.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath "/Library/Dictionaries") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath "/Library/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]WebSheet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath-prefix "${HOME}/Media/Safari") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]WebSheet[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]WebSheet[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]WebSheet-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]WebSheet-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/FairPlay") + (literal "/usr/sbin/fairplayd") + (subpath-prefix "${HOME}/Media") + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.accountsettings.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.accountsettings.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Mail/AutoFetchEnabled$" #"^/private/var/euser[0-9]+/Library/Mail/AutoFetchEnabled$")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebSheet.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]WebSheet.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]WebSheet[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]WebSheet[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]WebSheet[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]WebSheet$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]WebSheet[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.mobilemail") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.mobilesafari-settings") + (global-name "com.apple.marco") + (global-name "ScripterServer") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.librariand") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.webfilterd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.managedconfiguration.profiled") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.cookied") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.webinspector") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nehelper") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.aggregated") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.certui.relay") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.mobilemail.messageuiservices") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.eventpump") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.revisiond") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.GSSCred") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CoreMotion") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.da") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-exec* + (literal "/Applications/WebSheet.app/WebSheet")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb.xml new file mode 100644 index 0000000..c3c699a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/WebSheet.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb new file mode 100644 index 0000000..122443c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb @@ -0,0 +1,202 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iapd") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iapd")) +(allow process-exec* + (literal "/usr/sbin/accessoryd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb.xml new file mode 100644 index 0000000..7f2c4ab --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/accessoryd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb new file mode 100644 index 0000000..50b4563 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb @@ -0,0 +1,416 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.afc.root") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/AFCDEBUG") + (literal "/usr/libexec") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.afc.plist") + (literal "/usr/libexec/afcd") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (extension "com.apple.afc.root") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/Library/Preferences") + (literal "/Library/Preferences/SystemConfiguration") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private") + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.afc.root") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]afc$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.xpchelper") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.lockdown.host_watcher") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.afc") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/afcd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb new file mode 100644 index 0000000..c53cb0a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb @@ -0,0 +1,433 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Logs/AppConduit") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/db/MobileIdentityData") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/AppConduit") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath "/Developer") + (subpath "/private/var/containers/Bundle/Application") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/Logs/AirTraffic") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/AppConduit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging") + (subpath-prefix "${HOME}/Library/AppConduit") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/Logs/AirTraffic") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.atc.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.misagent") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.lsd.open") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cache_delete") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/appconduitd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb new file mode 100644 index 0000000..1d73ed5 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb @@ -0,0 +1,381 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/System/Library/CoreServices/SystemVersion$" #"^/System/Library/CoreServices/SystemVersion.+$") + (literal "/dev/zero") + (subpath "/private/etc") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/ApplePushService") + (subpath "/private/var/Keychains") + (subpath "/private/var/preferences") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/Managed Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Preferences") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/Library/Keychains") + (literal "/Library/Managed Preferences/mobile") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/usr") + (subpath "/private/var/tmp") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Logs") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/Managed Preferences/mobile") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicEffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicEffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") + (subpath-prefix "${HOME}/Library/Logs") + (subpath-prefix "${HOME}/Library/ApplePushService") + (subpath-prefix "${HOME}/Library/Preferences") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]apsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-inbound + (subpath "/")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/ApplePushService.framework/apsd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb.xml new file mode 100644 index 0000000..f81f602 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/apsd.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb new file mode 100644 index 0000000..81c89a6 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb @@ -0,0 +1,241 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (literal "/dev/random") + (subpath "/Applications") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/dev/dtracehelper") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assertiond.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assertiond.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-task-name) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.assertiond") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.assertiond")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (sysctl-name "kern.ipc.throttle_best_effort") + (sysctl-name "kern.memorystatus_vm_pressure_send")) +(allow sysctl-read) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb.xml new file mode 100644 index 0000000..972d53f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/assertiond.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb new file mode 100644 index 0000000..1f564bc --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb @@ -0,0 +1,19 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb.xml new file mode 100644 index 0000000..c5c1c88 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cloudphotod.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb new file mode 100644 index 0000000..b5abbb9 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb @@ -0,0 +1,455 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AssetCacheLocatorService.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssetCacheLocatorService$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.AssetCacheC") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound + (local udp "*:*")) +(allow network-bind + (local udp "*:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (remote udp "*:53") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AssetCacheLocatorService") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb new file mode 100644 index 0000000..aa5d599 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb @@ -0,0 +1,185 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/db/heim-credential-store.archive") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/db/heim-credential-store.archive") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.GSSCred.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb new file mode 100644 index 0000000..e42d3fa --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb @@ -0,0 +1,114 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb.xml new file mode 100644 index 0000000..857bf1d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Databases.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb new file mode 100644 index 0000000..270e152 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb @@ -0,0 +1,327 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ocspd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb.xml new file mode 100644 index 0000000..857bf1d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.Networking.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb new file mode 100644 index 0000000..342a2f4 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb @@ -0,0 +1,764 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Library/Dictionaries") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/random") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.LaunchServices.plist") + (literal "/dev/dtracehelper") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (vnode-type SYMLINK)) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "ScripterServer") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.assetimagegenerator") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.aggregated") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.bird.token") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.webinspector") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.sharingd") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.SpeakSelection") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.Preferences")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml new file mode 100644 index 0000000..857bf1d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb new file mode 100644 index 0000000..c4c6054 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb @@ -0,0 +1,683 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.token.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.avvc.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weather.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/siri_recordings") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.siri.backedup.encrypted.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath-prefix "${HOME}/Library/Assistant") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (subpath "/Library/Audio/Tunings") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AssistantServices.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.siri.") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/local/lib") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.siri.") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weather.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.token.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AssistantServices.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.siri.backedup.encrypted.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (subpath-prefix "${HOME}/Library/Assistant") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]AssistantServices$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]assistantd$") + (subpath-prefix "${HOME}"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.geod") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.marco") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.BTLEAudioController.xpc") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assistant_service") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.absd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.networkd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.absinthed") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.logger") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.avfoundation.avvc") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AssistantServices") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.assistant.token") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.siri.backedup.encrypted") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AssistantServices") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.token") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.siri.backedup.encrypted") + (preference-domain "com.apple.weather") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.assistant.backedup")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.assistant.assistantd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb new file mode 100644 index 0000000..915b281 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb @@ -0,0 +1,629 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents/")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.librarian.ubiquity-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.quicklook.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.clouddocs.version") + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CloudKit.BehaviorOptions.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ubd.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Mobile Documents.") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iCloudDriveApp.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bird.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath-prefix "${HOME}/Library/Logs/CloudDocs") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]bird" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]bird" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]bird") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (literal-prefix "${HOME}/Library/Mobile Documents.") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ubd.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iCloudDriveApp.plist") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bird.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") + (subpath-prefix "${HOME}/Library/Logs/CloudDocs") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]bird$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]bird$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]bird" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]bird" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]bird") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CloudKit")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.apsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.cache_delete") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird.ContainerMetadataExtractor") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.ubd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cloudd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.mmcs") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.iCloudDriveApp") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.iCloudDriveApp") + (preference-domain "com.apple.appleaccount")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-info + (info-type "hw.uuid")) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb.xml new file mode 100644 index 0000000..82828b2 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.bird.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb new file mode 100644 index 0000000..0a47bd1 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb @@ -0,0 +1,600 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (regex #"^/private/var/mobile/Containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #".+/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Library/Caches/CloudKit/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write")))) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (literal "/private/var/db/mds/messages/se_SecurityMessages") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (mount-relative-regex #"^/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/[.]DocumentRevisions-V100-bad-[0-9]+/") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal "/Library/Preferences/com.apple.security.plist") + (literal "/") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (regex #"^/private/var/tmp/CKTraffic$" #"^/private/var/tmp/CKTraffic[^/]+$") + (mount-relative-regex #"^/[.]DocumentRevisions-V100$" #"^/[.]DocumentRevisions-V100/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/Library/Keychains/System.keychain") + (subpath-prefix "${HOME}/Library/Keychains") + (literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (mount-relative-regex #"^/[.]TemporaryItems$" #"^/[.]TemporaryItems/") + (extension "com.apple.sandbox.executable") + (literal "/private/var/db/DetachedSignatures") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.migration.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/var/tmp$" #"^/var/tmp/" #"^/private/var/tmp$" #"^/private/var/tmp/") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/CloudKit") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/Logs/Ubiquity") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/run/diagnosticd/dyld_shared_cache_x86_64") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (literal "/private/var/logs/Ubiquity") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/db/mds/system/mdsDirectory.db") + (subpath "/usr/lib") + (literal "/Library/Preferences/SystemConfiguration/preferences.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]cloudd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (regex #"^/var/tmp$" #"^/private/var/tmp$") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library") + (literal "/AppleInternal") + (literal "/etc") + (literal "/tmp") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/etc/localtime") + (literal "/Library/Keychains") + (literal "/private/var/run/systemkeychaincheck.done") + (literal "/Library/Logs") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/var$" #"^/private/var$") + (literal "/Library") + (literal "/Library/Security/Trust Settings/Admin.plist") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (regex #"^/var/tmp$" #"^/var/tmp/" #"^/private/var/tmp$" #"^/private/var/tmp/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (mount-relative-regex #"^/[.]TemporaryItems$" #"^/[.]TemporaryItems/") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Caches/CloudKit") + (literal "/") + (regex #"^/Library/Keychains/System.keychain") + (subpath-prefix "${HOME}/Library/Logs/Ubiquity") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (subpath-prefix "${HOME}/Library/Keychains") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (regex #"^/private/var/tmp/CKTraffic$" #"^/private/var/tmp/CKTraffic[^/]+$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/logs/Ubiquity") + (literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]cloudd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]cloudd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000))) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_com.apple.cloudd") + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write-xattr + (mount-relative-regex #"^/[.]DocumentRevisions-V100$" #"^/[.]DocumentRevisions-V100/") + (mount-relative-regex #"^/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/[.]DocumentRevisions-V100-bad-[0-9]+/")) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name-regex #"^/tmp/com[.]apple[.]csseed[.][0-9]+$") + (ipc-posix-name "FNetwork.defaultStorageSession") + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.quarantine-resolver") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.datamigrator") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.apsd") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.fairplayd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.awdd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.networkd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.windowserver.active") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.ocspd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.migration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.cloudd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb new file mode 100644 index 0000000..63d6d8f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb @@ -0,0 +1,210 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (subpath "/Applications") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilephone.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.message") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilephone") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb new file mode 100644 index 0000000..f99f488 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb @@ -0,0 +1,724 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath-prefix "${HOME}/Library/HomeConfiguration") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (subpath-prefix "${HOME}/Library/homed") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homed.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]homed" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]homed") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") + (subpath-prefix "${HOME}/Library/HomeConfiguration") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homed.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/homed") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]homed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]homed" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]homed") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]homed$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.corefollowup.agent") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.apsd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.pegasus") + (global-name "com.apple.revisiond") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cloudd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.homed") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.homed")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.homed.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb new file mode 100644 index 0000000..86468d4 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb @@ -0,0 +1,491 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/private/var/root/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath "/private/var/root/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (literal "/usr/local/bin/network_test") + (literal "/dev/random") + (literal "/dev/ptmx") + (subpath "/usr/libexec") + (subpath "/private/var/root/Library/Cookies") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Bundle/Application") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (subpath "/usr/sbin") + (subpath "/Developer") + (regex #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (regex #"^/private/var/root/Library/Caches/nehelper/" #"^/private/var/root/Library/Caches/nehelper$") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (regex #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (subpath "/private/var/root/Library/Cookies") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nehelper$"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.processassertionconnection") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow mach-register + (global-name "com.apple.nehelper") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network* + (local udp "*:500") + (local udp "*:4500") + (literal "/private/var/run/racoon.sock")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote udp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.net.utun_control") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (remote tcp "*:*") + (control-name "com.apple.netsrc") + (control-name "com.apple.content-filter") + (control-name "com.apple.flow-divert") + (control-name "com.apple.net.necp_control") + (control-name "com.apple.net.ipsec_control")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl* + (sysctl-name-regex #"^net[.]inet[.]ipsec[.].+") + (sysctl-name-regex #"^net[.]necp[.].+")) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb.xml new file mode 100644 index 0000000..c8ed3bf --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nehelper.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb new file mode 100644 index 0000000..3c3cae9 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb @@ -0,0 +1,466 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (literal "/dev/random") + (subpath "/usr/libexec") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/run/racoon.pid") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.networkextension.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]necp[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]control[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.]cache[.]plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$") + (subpath "/private/etc/ppp") + (subpath "/usr/sbin") + (subpath "/private/var/containers/Bundle/VPNPlugin") + (regex #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (subpath "/private/var/run/racoon") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/run/racoon") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/log/ppp.log") + (regex #"^/private/var/preferences/SystemConfiguration/preferences[.]plist") + (subpath "/private/var/tmp") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (regex #"^/private/var/root/Library/Caches/nesessionmanager/" #"^/private/var/root/Library/Caches/nesessionmanager$") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/nesessionmanager$"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.UNCUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptom_analytics") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.neagent") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.ocspd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.networkextension") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/usr/sbin/pppd")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (sysctl-name "net.key.natt_keepalive_interval")) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb.xml new file mode 100644 index 0000000..aa4f26a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.nesessionmanager.sb.xml @@ -0,0 +1,46 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb new file mode 100644 index 0000000..3a766d1 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb @@ -0,0 +1,466 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.mediaserverd.read"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") + (literal "/dev/random") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") + (extension "com.apple.sandbox.executable") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.quicklook.readonly") + (subpath "/Developer") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Application Support/Quick Look") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Application Support/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Application Support/Documents") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") + (literal-prefix "${HOME}/Library/Application Support/Quick Look") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support/Quick Look")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.pegasus") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.system.logger") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.revisiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 31))) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb new file mode 100644 index 0000000..1a731fe --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb @@ -0,0 +1,494 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/rtcreportingd.plist") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoConference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.rtcreporting.plist") + (literal "/dev/random") + (literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.timed.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (extension "com.apple.rtcreporting.upload") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") + (literal "/usr/libexec/rtcreportingd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-data + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/rtcreportingd.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.rtcreporting.plist") + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Library/Caches/rtcreportingd/" #"^/private/var/mobile/Library/Caches/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/rtcreportingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (extension "com.apple.rtcreporting.upload") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.tccd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlogd") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "rtcreportingd") + (preference-domain "com.apple.timed") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.rtcreporting") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.rtcreporting") + (preference-domain "rtcreportingd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.rtcreportingd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb new file mode 100644 index 0000000..a998437 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb @@ -0,0 +1,67 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/dtracehelper")) +(allow file-link) +(allow file-map-executable) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-write* + (extension "com.apple.sandbox.system-group") + (subpath "/private/var/tmp") + (regex #"^/private/var/logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/logs/CrashReporter/[.]Sandbox-.+[.]ips") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Sandbox-.+[.]ips") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero")) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.logger") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.system.libinfo.muser") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coresymbolicationd")) +(allow network* + (regex #"^/private/var/tmp/sandbox[.]")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (regex #"^/private/tmp/[.]webdavUDS[.][^/]+$") + (literal "/private/var/run/asl_input")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb.xml new file mode 100644 index 0000000..3cfb47d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.sandboxd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb new file mode 100644 index 0000000..943abf2 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb @@ -0,0 +1,207 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.siri.ClientFlow.ClientScripter.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.siri.ClientFlow.ClientScripter.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.siri.ClientFlow.ClientScripter") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.siri.ClientFlow.ClientScripter")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb new file mode 100644 index 0000000..7203d9c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb @@ -0,0 +1,139 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/var/mobile/Library/Caches") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-register + (global-name "com.apple.snhelper") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.snhelper.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb new file mode 100644 index 0000000..0084590 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb @@ -0,0 +1,450 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class-regex #"^com[.]apple[.]tcc[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.companionsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/null") + (literal "/dev/random") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (subpath-prefix "${HOME}/Library/TCC") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (subpath "/private/var/tmp/com.apple.tccd") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (global-name "com.apple.appconduitd.device-connection") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.backboard.systemservices") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.librariand") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.awdd") + (global-name "com.apple.companionappd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.companionsync") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb.xml new file mode 100644 index 0000000..1460650 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tccd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb new file mode 100644 index 0000000..c05eade --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb @@ -0,0 +1,140 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write-create + (literal "/private/var/db/timezone/localtime") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-unlink + (literal "/private/var/db/timezone/localtime") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.tzlinkd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb new file mode 100644 index 0000000..ab9d58d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb @@ -0,0 +1,527 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") + (literal "/") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ubd.plist") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/processed-Mobile Documents.delete") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Logs/awd/awd-ubd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${HOME}/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bird.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Collections") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]ubd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Collections") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Logs/awd/awd-ubd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ubd.plist") + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/processed-Mobile Documents.delete") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mmcs.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]ubd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]ubd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]ubd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]ubd$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.absd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.apsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.awdd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.absinthed") + (global-name "com.apple.networkd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.mmcs") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.mmcs")) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Support/ubd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30))) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb.xml new file mode 100644 index 0000000..f9ff07c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/com.apple.ubd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb new file mode 100644 index 0000000..8e41b0f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb @@ -0,0 +1,3520 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (extension-class "com.apple.mediaserverd.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/ReplayKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ReplayKit.RPVideoEditorExtension"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}"))) +(allow file-map-executable) +(allow file-read* + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/Developer") + (subpath "/usr/share") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.security.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]mobilemail") + (subpath-prefix "${FRONT_USER_HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/OriginalLockVideo.mov") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/HomeBackground.cpbitmap") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath-prefix "${HOME}/Media") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/OriginalHomeVideo.mov") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (require-entitlement "platform-application")) + (require-all + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath "/Library/Application Support/Mail/Plugins") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "platform-application")) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/LockBackgroundThumbnail.jpg") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.Maps") + (entitlement-value "com.apple.SafariViewService") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/LockVideo.mov") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-shm") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/HomeBackgroundThumbnail.jpg") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/.LockBackground.cpbitmap") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.security.exception.carrier-bundle.read"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal "/System/Library/PairedSyncServices/com.apple.pairedsync.mail.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/LockBackground.cpbitmap") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-wal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/.HomeBackground.cpbitmap") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.apsalerts.plist")) + (require-any + (subpath "/AppleInternal") + (subpath "/Applications") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/Library/Ringtones") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (subpath "/Library/Dictionaries") + (subpath-prefix "${HOME}/Library/Dictionaries") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/dtracehelper") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/euser[0-9]+/Library/GameKit/Data/[^/]+.gcdata$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/SpringBoard/HomeVideo.mov") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.AutoWake.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.Maps") + (entitlement-value "com.apple.SafariViewService") + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))) +(allow file-read-data + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library") + (literal "/private/var") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/printd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/GameKit/Data") + (literal-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (vnode-type SYMLINK) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2")))) +(allow file-write* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtube.dp.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.OTASyncState.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mobilemail" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]mobilemail") + (subpath-prefix "${FRONT_USER_HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mail.composition.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-journal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.internal.Voltaire.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.OTASyncAgent.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMailKit.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MailAccount-ExtProperties.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.skyhookwireless.wps.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cloud.quota.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cloud.quota.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb-wal") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored.2.sqlitedb") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (require-all + (iokit-user-client-class "RootDomainUserClient") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2")))) +(allow iokit-get-properties + (iokit-property "compass-calibration") + (iokit-property "gyro-interrupt-calibration") + (require-not (iokit-property-regex #"-mac-address" #"mac-address-" #".+-mac-address" #".+mac-address-")) + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access")) +(allow ipc-posix-sem + (semaphore-owner self) + (extension "com.apple.sandbox.application-group")) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^stack-logs") + (ipc-posix-name-regex #"^OA-") + (extension "com.apple.sandbox.application-group") + (ipc-posix-name-regex #"^/FSM-")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-create + (ipc-posix-name-regex #"^/mono[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-unlink + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.telephonyutilities.callservicesdaemon.voip") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.appleprofilepolicyd") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.imavagent.embedded.auth") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.symptomsd") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.watchconnectivity.complication") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.mobileipod.MPMusicPlayerMigServerExists") + (global-name "com.apple.iapd") + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.AdSheetPhone.server") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.gamed") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.coremedia.wirelessdisplayserver") + (global-name "com.apple.TextInput") + (global-name "com.apple.mobileipod.MPMusicPlayerMigServer") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.cloudd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.commcenter.dm-helper") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.wcd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.Music.MPMusicPlayerControllerInternal") + (global-name "com.apple.bird") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.wapi.client") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.iaptransportd") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.FileProvider") + (global-name "com.apple.midiserver.io") + (global-name "com.apple.Music.MPMusicPlayerMigServerExists") + (global-name "com.apple.awdd") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.telephonyutilities.remotelogdaemon") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.xpcd") + (global-name "com.apple.diagnosticd") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.marco") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.cvmsCompAgent_armv7") + (global-name "com.apple.Music.MPMusicPlayerMigServer") + (global-name "com.apple.certui.relay") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.weibod.server") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.webfilterd") + (global-name "com.apple.gizmoappd") + (global-name "com.apple.passd.assertions") + (global-name "com.apple.backboard.watchdog") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.ReportCrash") + (global-name "com.apple.atc") + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.dataaccess.dataaccessd") + (global-name "com.apple.nehelper") + (global-name "com.apple.backboard.workspaceserverconnection") + (global-name "com.apple.scrod") + (global-name "com.apple.syncdefaultsd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.TextInput.rdt") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.testmanagerd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.calaccessd") + (global-name "com.apple.lsd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.assetsd.notificationServer") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.MobileFileIntegrity") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.prdaily") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.iaptransportd.xpc") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.audio.AudioConverterServer") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.springboard.watchdogserver") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.accountsd.authmanager") + (global-name "com.apple.audio.AudioUnitServer") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.AdSheetPad.server") + (global-name "com.apple.ondemandd.client") + (global-name "com.apple.dataaccess.dataaccessd.active") + (global-name "com.apple.ReportCrash.StackShot") + (global-name "com.apple.mDNSResponder") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.springboard.remotenotifications") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.audio.AudioFileServer") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.iap2d.distributednotification.server") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.iapauthd.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.coremedia.formatreader") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.itunesstored.xpc") + (global-name "PurplePPTServer") + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.midiserver") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.videoconference.avconference") + (global-name "com.apple.iap2d.xpc") + (global-name "com.apple.assetsd.messagingServer") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.managedconfiguration.mdmdpush-prod") + (global-name "com.apple.coremedia.cpeprotector") + (global-name "com.apple.MobileAccessoryUpdater") + (global-name "com.apple.iap2d") + (global-name "com.apple.aggregated") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.itdbprep.server") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.healthd.server") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.springboard") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.airplay.sender.xpc") + (global-name "com.apple.coremedia.wirelessdisplay") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.gamecenter") + (global-name "com.apple.fairplayd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.iapd.distributednotification.server") + (global-name "com.apple.mediastream.sharing-nowake") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.bird.token") + (global-name "com.apple.datamigrator.dz") + (global-name "com.apple.managedconfiguration.mdmdpush-dev") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.accountsd.accessmanager") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.distributed_notifications@0v3") + (global-name "com.apple.VoiceOverTouch") + (global-name "com.apple.managedconfiguration.mdmdservice") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.mobile.softwareupdated") + (global-name "com.apple.coremedia.audioprocessingtap") + (global-name "com.apple.iTunesStore.daemon.notifications.public") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.vsassetd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.gamed.note") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.sharingd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.iapd.xpc") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.springboard.alerts") + (global-name "com.apple.passd.library") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.backboard.checkin") + (global-name "ScripterServer") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.clouddbd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.GSSCred") + (global-name "com.apple.assetsd.keepDaemonAlive") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.MediaControl.daemon") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.springboard.UIKit.migserver") + (global-name "com.apple.iTunesStore.daemon.public") + (global-name "com.apple.instruments.server.mig") + (global-name "com.apple.ReportCrash.SafetyNet") + (global-name "com.apple.system.logger") + (global-name "com.apple.healthd.restriction") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.mobileipod.MPMusicPlayerControllerInternal") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.sandboxd") + (global-name "com.apple.VoiceOverTouch.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ReportCrash.Jetsam") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.geod") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.ait.client") + (global-name "com.apple.coremedia.cpe") + (global-name "com.apple.commcenter.mobile-helper") + (global-name "com.apple.bypassBasebandAutoBooter.msgport") + (global-name "com.apple.webinspector") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.passd.in-app-payment") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.ReportCrash.DirectoryService") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.iapauthd") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.UIKit.pasteboardd") + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.siri.vocabularyupdates") + (require-entitlement "com.apple.siri.synapse")) + (require-all + (global-name "com.apple.parsec.subscriptionservice.internal") + (require-entitlement "com.apple.private.subscriptionservice.internal")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.observerconnection") + (require-entitlement "com.apple.bulletinboard.observer")) + (require-all + (global-name "com.apple.pegasus") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.identityservicesd.embedded.auth") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.coremedia.recorder") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.assistant.analytics") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.lskdd") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.coreduetd") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.cache_delete") + (require-any + (require-entitlement "com.apple.mobile.deleted.AllowFreeSpace") + (require-entitlement "com.apple.private.CacheDelete"))) + (require-all + (global-name "com.apple.mediaserverd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.utilitiesconnection") + (require-entitlement "com.apple.bulletinboard.utilities")) + (require-all + (global-name "com.apple.backupd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coreduetd") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.parsec.subscriptionservice") + (require-entitlement "com.apple.smoot.subscriptionservice")) + (require-all + (global-name "com.apple.Maps.SpringBoard") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.asset") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (local-name "com.apple.iphone.axserver") + (require-entitlement "com.apple.accessibility.api")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.suggestd.events") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobilestoredemod") + (require-entitlement "com.apple.private.mobilestoredemo.enabledemo")) + (require-all + (global-name "com.apple.coremedia.admin") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.bulletinboard.settings")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.harvestd.manager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.icfcallserver") + (require-entitlement "com.apple.private.icfcallserver")) + (require-all + (global-name "com.apple.familycircle.agent") + (require-entitlement "com.apple.private.familycircle")) + (require-all + (global-name "com.apple.bulletinboard.systemstateconnection") + (require-entitlement "com.apple.bulletinboard.systemstate")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.nanomaps.xpc.Maps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal"))) + (require-all + (global-name "com.apple.safarifetcherd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.suggestd.mail") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.AOSNotification") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.suggestd.contacts") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.mobilesafari-settings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebSheet"))) + (require-all + (global-name "com.apple.absinthed") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.medialibraryd.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.spotlight.SearchAgent") + (require-entitlement "com.apple.spotlight.search")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.managedconfiguration.profiled") + (require-entitlement "com.apple.managedconfiguration.profiled-access")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.suggestd.spotlight") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.unfreed") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.Maps.mapspushd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (global-name "com.apple.bulletindistributord.server") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.replayd") + (require-not (process-attribute is-plugin))) + (require-all + (global-name "com.apple.aps.alertprovider.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.icloud.findmydeviced") + (require-any + (require-entitlement "com.apple.aosnotification.aosnotifyd-access") + (require-entitlement "com.apple.icloud.findmydeviced.access"))) + (require-all + (global-name "com.apple.SystemConfiguration.PPPController-priv") + (require-entitlement "com.apple.networking.vpn.configuration")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (require-not (global-name-regex #"-idswake$" #".+-idswake$")) + (require-any + (local-name "com.apple.accessibility.gax.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (extension "com.apple.sandbox.application-group") + (local-name "com.apple.iphone.axserver") + (require-all + (global-name "com.apple.Music.MPMusicPlayerMigServerExists") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (global-name "com.apple.Music.MPMusicPlayerControllerInternal") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))))) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (require-all + (require-not (remote tcp "localhost:22")) + (require-not (remote tcp "localhost:23")) + (require-not (remote tcp "localhost:873")) + (require-not (remote tcp "localhost:62078")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/printd") + (remote ip "*:*") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/") + (subpath-prefix "${HOME}")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-entitlement "platform-application"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mobile.SyncMigrator") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.gamekit") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.managedconfiguration.janitor") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.da") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.certui") + (preference-domain "com.apple.voicemail") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobilecal.alarmengine") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.madrid") + (preference-domain "com.apple.softwareupdateservicesd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.atc") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.mobileme.fmf.assistant") + (preference-domain "itdbprepserver") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mediaremote") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.apsd") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.OTASyncState") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.XCTest") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.network.eapclient.tls.TrustExceptions") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobilevpn") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.itdbprep.server") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.mobiletimer") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.messagesbadgecontroller") + (preference-domain "com.apple.preferences.datetime") + (preference-domain "com.apple.iqagent") + (preference-domain "mediaremote") + (preference-domain "com.apple.MobileAddressBook") + (preference-domain "com.apple.nike") + (preference-domain "com.apple.imagent") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.VoiceMemos") + (preference-domain "com.apple.preferences.network") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.mobilestoresettings") + (require-all + (preference-domain "com.apple.internal.Voltaire") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.homesharing") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.AppStore") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.NanoMailKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.MobileStore") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.coreaudio") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (preference-domain "com.apple.demo-settings") + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.skyhookwireless.wps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.medialibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (preference-domain "com.apple.MailAccount-ExtProperties") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.WebFoundation") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (preference-domain "com.apple.avfoundation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.coremedia") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.OTASyncAgent") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaaccessibility.public") + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.internal.Voltaire") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.OTASyncAgent") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.iBooks") + (entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.NanoMailKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.MailAccount-ExtProperties") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.skyhookwireless.wps") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) +(allow process-info-pidinfo + (target self) + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension"))) +(allow process-info-pidfdinfo + (target self) + (require-entitlement "com.apple.security.exception.process-info")) +(allow process-info-setcontrol + (target self)) +(allow pseudo-tty) +(allow signal + (target self) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension")) + (require-all + (target others) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd")))) +(allow sysctl-read + (require-all + (sysctl-name-regex #"^kern[.]proc[.]") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-not (sysctl-name "kern.proc.pid.1")) + (require-any + (require-not (sysctl-name-regex #"^kern[.]proc[.]")) + (require-entitlement "com.apple.DiagnosticExtensions.extension")))) +(allow system-info + (require-all + (info-type "net.link.addr") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain 39) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps")) + (require-entitlement "com.apple.network.multipath-tcp")))) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb.xml new file mode 100644 index 0000000..d3f890f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/container.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb new file mode 100644 index 0000000..1cd194d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb @@ -0,0 +1,411 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath "/private/var/mobile/Library/MobileContainerManager") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") + (literal "/private/var/root/Library/MobileContainerManager.") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$") + (subpath "/private/var/db/timezone") + (literal "/private/var/mobile/Library/MobileContainerManager.") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/private/var/installd/Library/Caches") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath "/private/var/mobile/Library/Logs/MobileContainerManager") + (subpath "/private/var/root/Library/Logs/MobileContainerManager") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/containers") + (literal "/dev/aes_0") + (subpath "/private/var/root/Library/MobileContainerManager") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/installd/Library") + (literal "/private/var/mobile/Library"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd") + (literal "/private/var/root/Library/MobileContainerManager.") + (subpath "/private/var/mobile/Library/MobileContainerManager") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers") + (subpath "/private/var/mobile/Library/Logs/MobileContainerManager") + (literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") + (subpath "/private/var/root/Library/Logs/MobileContainerManager") + (subpath "/private/var/containers") + (literal "/private/var/mobile/Library/MobileContainerManager.") + (subpath "/private/var/root/Library/MobileContainerManager") + (subpath "/private/var/installd/Library/Caches") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]containermanagerd$") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/installd/Library") + (literal "/private/var/mobile/Library"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]containermanagerd$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow ipc-posix-sem + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/containermanagerd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb new file mode 100644 index 0000000..8bccf5e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb @@ -0,0 +1,170 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/root/Library/Caches/com.apple.coresymbolicationd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library/Caches/com.apple.coresymbolicationd") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/coresymbolicationd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb new file mode 100644 index 0000000..787a2cf --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb @@ -0,0 +1,173 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Logs") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/logs/WirelessLibraryLogs") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/private/var/logs/MobileLibraryLogs") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/logs/MobileMediaFactoryLogs") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath "/private/var/logs/MobileLibraryLogs") + (subpath "/private/var/logs/MobileMediaFactoryLogs") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/cplogd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb new file mode 100644 index 0000000..19b1a64 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb @@ -0,0 +1,512 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") + (literal "/dev/urandom") + (subpath-prefix "${HOME}/Library/Logs/DataMigration") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (subpath-prefix "${HOME}/Library/Mail") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Logs") + (subpath "/AppleInternal/Library/Frameworks") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") + (extension "com.apple.sandbox.executable") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.autoincrement.lock") + (subpath "/System/Library") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/DataAccess") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath-prefix "${HOME}/Library/Logs/DataAccess") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Library/Notes") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Preferences") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Logs/Message") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobilesafari/ReadingListArchives") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Logs/ManagedConfiguration") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Safari") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/euser[0-9]+/Library/")) + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Cookies/com.apple.dataaccessd.binarycookies" #"^/private/var/mobile/Library/Cookies/com.apple.dataaccessd..+binarycookies" #"^/private/var/euser[0-9]+/Library/Cookies/com.apple.dataaccessd..*binarycookies") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/DataMigration") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath "/private/var/Managed Preferences/mobile") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/Logs/DataAccess") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Library/Mail") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock") + (subpath-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/Logs/Message") + (subpath-prefix "${HOME}/Library/Logs/ManagedConfiguration") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.notes.autoincrement.lock") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") + (subpath-prefix "${HOME}/Library/DataAccess") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal-prefix "${HOME}/Library/Safari") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]dataaccess[.]dataaccessd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Cookies/com.apple.dataaccessd.binarycookies" #"^/private/var/mobile/Library/Cookies/com.apple.dataaccessd..+binarycookies" #"^/private/var/euser[0-9]+/Library/Cookies/com.apple.dataaccessd..*binarycookies") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Safari")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobilesafari/ReadingListArchives") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb.xml new file mode 100644 index 0000000..b7536db --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/dataaccessd.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb new file mode 100644 index 0000000..7f7e939 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb @@ -0,0 +1,166 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (subpath "/Applications") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-priv-task-port) +(allow network-inbound + (local tcp "localhost:*") + (remote tcp "localhost:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Containers")) + (require-not (subpath "/private/var/containers")) + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-debug) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb.xml new file mode 100644 index 0000000..c2f49fe --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/debugserver.sb.xml @@ -0,0 +1,46 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb new file mode 100644 index 0000000..da7daa3 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb @@ -0,0 +1,251 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cache_delete.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (subpath "/AppleInternal/Library/CacheDelete") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath-prefix "${HOME}/Library/Logs/CacheDelete") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/AppleInternal/Library/CacheDelete") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.cache_delete.plist") + (subpath-prefix "${HOME}/Library/Logs/CacheDelete") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name-regex #"^com[.]apple[.]mobile[.]cache_delete_") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name-regex #"^com[.]apple[.].+cache-delete$") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name-regex #"^com[.]apple[.].+[Cc]ache[Dd]elete$") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.cache_delete") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.cache_delete")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 24))) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/deleted.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb new file mode 100644 index 0000000..37135f0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb @@ -0,0 +1,337 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Logs/coreduetd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Logs/duetexpertd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath "/usr/libexec") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/DuetExpertCenter") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.spotlightui.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DuetExpertCenter.AppPredictionExpert.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.duetexpertd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (subpath-prefix "${HOME}/Library/Logs/CallHistory") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${HOME}/Library/DuetExpertCenter") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DuetExpertCenter.AppPredictionExpert.plist") + (literal-prefix "${HOME}/Library/Logs/coreduetd.log") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.duetexpertd.plist") + (subpath-prefix "${HOME}/Library/Logs/CallHistory") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/duetexpertd.log") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.calaccessd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.routined.registration") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.aggregated") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.duet.expertcenter") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coreduetd.knowledgebase") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.duetexpertd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.MobileAsset") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.duetexpertd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/duetexpertd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb new file mode 100644 index 0000000..78f0f67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb @@ -0,0 +1,654 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.notbackedup.plist") + (literal "/dev/null") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.notbackedup.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.migration.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/empty") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/MDM.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.notbackedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal "/usr/libexec/findmydeviced") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.watch.notbackedup.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.managedconfiguration.notbackedup.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]findmydeviced" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]findmydeviced" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]icloud[.]findmydeviced") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/MDM.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/MDM.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/MDM.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.notbackedup.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.watch.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.notbackedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]findmydeviced" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]findmydeviced" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]icloud[.]findmydeviced") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]findmydeviced$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (regex #"^/private/var/mobile/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/euser[0-9]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "ProvInfoIOKitUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem + (ipc-posix-name "findmydeviced.boot_check")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "com.apple.absd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.apsd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.adid") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.absinthed") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.icloud.findmydeviced.FMIPAccounts.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.FMIPAccounts") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.icloud.findmydeviced.watch.notbackedup") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.managedconfiguration.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.notbackedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.icloud.findmydeviced.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.FMIPAccounts") + (preference-domain "com.apple.icloud.findmydeviced.FMIPAccounts.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.icloud.findmydeviced.watch.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/findmydeviced.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb new file mode 100644 index 0000000..736460d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb @@ -0,0 +1,592 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/usr/libexec") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.fmfd.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.fmfd.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/usr/libexec/fmfd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal "/private/var/empty") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]icloud[.]fmfd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.fmfd.notbackedup.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.fmfd.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]icloud[.]fmfd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]icloud[.]fmfd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]icloud[.]fmfd$") + (subpath-prefix "${HOME}"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.geod") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.apsd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.marco") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.fmfd") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.icloud.fmfd.notbackedup") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.da") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.icloud.fmfd") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.icloud.fmfd.notbackedup")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/fmfd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb new file mode 100644 index 0000000..71ca0f9 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb @@ -0,0 +1,137 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.xpcd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pfd") + (global-name "com.apple.tccd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (local ip "*:*") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb.xml new file mode 100644 index 0000000..cf8816c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ftp-proxy-embedded.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb new file mode 100644 index 0000000..d78ceb2 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb @@ -0,0 +1,591 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/GameKit") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/usr/libexec/gamed") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoConference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (subpath-prefix "${HOME}/Library/GameKit") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath-prefix "${HOME}/Library/Logs/GameKit") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gamed.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/GameKit") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gamecenter.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]gamed") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath-prefix "${HOME}/Library/Caches/GameKit") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gamecenter.plist") + (subpath-prefix "${HOME}/Library/GameKit") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath-prefix "${HOME}/Library/Logs/GameKit") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gamed.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]gamed" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]gamed") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.marco") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.authkit.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.apsd") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.lsd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.gamecenter") + (global-name "com.apple.fairplayd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.pegasus") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.networkd") + (global-name "com.apple.gamecenter.gsEvents") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote ip "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.accountsd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.PeoplePicker")) +(allow process-exec* + (literal "/usr/libexec/gamed")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb.xml new file mode 100644 index 0000000..c3c699a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gamed.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb new file mode 100644 index 0000000..1f564bc --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb @@ -0,0 +1,19 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb.xml new file mode 100644 index 0000000..c5c1c88 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geocorrectiond.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb new file mode 100644 index 0000000..f7430a7 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb @@ -0,0 +1,483 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal "/dev/urandom") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Caches/MapTiles") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/GeoServices") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (literal "/dev/random") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/CloudConfigurationDetails.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GMM.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") + (subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") + (subpath-prefix "${HOME}/Library/GeoServices") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal-prefix "${HOME}/Library/Caches/MapTiles") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/MapTiles"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (remote ip "*:*") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GMM") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ConfigServer") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.GMM")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/geod.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb new file mode 100644 index 0000000..473c797 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb @@ -0,0 +1,483 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gizmoappd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (subpath "/private/var/containers/Bundle/Application") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Preferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Preferences/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.gizmoappd.plist") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Preferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Preferences/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gizmoappd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.carousel.tilenavigation") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.misagent") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.carousel.glanceservice") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.lsd.open") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cache_delete") + (global-name "com.apple.carousel.backlightxpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.gizmoappd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb.xml new file mode 100644 index 0000000..1460650 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gizmoappd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb new file mode 100644 index 0000000..abce251 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb @@ -0,0 +1,394 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/root/Library/Caches/com.apple.opengl") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/GPUTools") + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]gputoolsd$") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]gputoolsd$"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "IOAccelContext")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.system.logger") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.appwatchdog") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.lockdown.host_watcher") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-priv-task-port) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/gputoolsdhelper.sock") + (local tcp "localhost:*") + (regex #"^/private/var/run/lockdown/checkin") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/Developer/usr/libexec/gputoolsd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb.xml new file mode 100644 index 0000000..46d08f3 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/gputoolsd.sb.xml @@ -0,0 +1,50 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb new file mode 100644 index 0000000..c7a16cd --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb @@ -0,0 +1,515 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Fitness.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanolifestyle.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.companionsync.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanolifestyle.privacy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.healthlite.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.healthd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/Applications/Fitness.app") + (subpath "/private/var/tmp") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Health") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/Applications/Health.app") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (literal-prefix "${HOME}/Library/CompanionSyncCaches") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanolifestyle.plist") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Fitness.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal-prefix "${HOME}/Library/CompanionSyncCaches") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.healthd.plist") + (subpath-prefix "${HOME}/Library/Health") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") + (literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanolifestyle.privacy.plist") + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/CompanionSyncCaches"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.springboard.services") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.routined.registration") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.marco") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coreduetd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.awdd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.healthlite") + (preference-domain "com.apple.Fitness") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.nanolifestyle") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.nanolifestyle.privacy") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Fitness") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.nanolifestyle") + (preference-domain "com.apple.nanolifestyle.privacy")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/healthd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb new file mode 100644 index 0000000..fd7d877 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb @@ -0,0 +1,559 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (subpath-prefix "${HOME}/Media/Radio") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.TelephonyUtilities.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.logging.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (subpath "/usr/sbin") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/iTunes_Control") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iaptransportd.plist") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iap2d.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Radio") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath-prefix "${HOME}/Media/iTunes_Control") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iap2d.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iaptransportd.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]iapd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-bind + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote udp "*:*") + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.iaptransportd") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.iap2d") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.da") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iap2d") + (preference-domain "com.apple.iaptransportd") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mediaremote")) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iap2d") + (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iapd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-kext-load + (kext-bundle-id "com.apple.driver.AppleUSBAudio") + (kext-bundle-id "com.apple.driver.AppleUSBDeviceAudioController") + (kext-bundle-id "com.apple.driver.usb.IOUSBHostHIDDevice") + (kext-bundle-id "com.apple.driver.usb.cdc.ecm") + (kext-bundle-id "com.apple.driver.usb.networking") + (kext-bundle-id "com.apple.driver.usb.cdc.ncm") + (kext-bundle-id "com.apple.driver.usb.cdc")) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb.xml new file mode 100644 index 0000000..5885e3b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/iapd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb new file mode 100644 index 0000000..e44936e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb @@ -0,0 +1,576 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/bin/sh") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.deviceproperties.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (extension "com.apple.identityservices.send") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (subpath "/AppleInternal") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.identityservices.idstatuscache.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.setmme") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.registration.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.migration.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.notbackedup.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.subservices.plist") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/IdentityServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.identityservicesd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/usr/local/bin/figplaySS") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]identityservicesd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]identityservicesd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]identityservicesd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.identityservices.idstatuscache.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Library/IdentityServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.identityservicesd.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") + (extension "com.apple.identityservices.send") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.deviceproperties.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.subservices.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]identityservicesd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]identityservicesd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]identityservicesd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.marco") + (global-name "com.apple.absd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.datamigrator") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.apsd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.imtransferservices.IMTransferAgent") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.awdd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.absinthed") + (global-name "com.apple.networkd") + (global-name "com.apple.idscredentialsagent.embedded.auth") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name-regex #"-idswake$" #".+-idswake$") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog") + (remote ip "*:*") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.ids.subservices") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.da") + (preference-domain "com.apple.registration") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.identityservicesd") + (preference-domain "com.apple.identityservices.idstatuscache") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.ids.deviceproperties") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.ids.deviceproperties") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.ids.subservices") + (preference-domain "com.apple.identityservicesd") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.identityservices.idstatuscache") + (preference-domain "com.apple.conference")) +(allow process-exec* + (literal "/bin/sh") + (literal "/usr/local/bin/figplaySS")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb.xml new file mode 100644 index 0000000..78d5266 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/identityservicesd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb new file mode 100644 index 0000000..73ea0ee --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb @@ -0,0 +1,569 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media/Downloads")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (subpath-prefix "${HOME}/Library/Caches/Snapshots") + (subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Media") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/MusicLibrary") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal "/dev/random") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]itunesstored" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]itunesstored" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]itunesstored") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/MusicLibrary") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/Snapshots") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]itunesstored" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]itunesstored" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]itunesstored") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]itunesstored$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.absd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.cookied") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.apsd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.adid") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.cache_delete") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.absinthed") + (global-name "com.apple.networkd") + (global-name "com.apple.ondemandd.itunesstored") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.medialibrary") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itunesstored")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/itunesstored.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb new file mode 100644 index 0000000..4f5d5d4 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb @@ -0,0 +1,419 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelContext2")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.iohideventsystem") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.xpcd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.fig.movie") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.uikit.GestureServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/syslog") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info-pidinfo + (require-entitlement "com.apple.security.exception.process-info")) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb.xml new file mode 100644 index 0000000..bc9a832 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/keyboard.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb new file mode 100644 index 0000000..787af27 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb @@ -0,0 +1,353 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.librarian.ubiquity-container"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (literal "/dev/random") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${HOME}/Library/Application Support") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/db/timezone") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.librariand.plist") + (subpath-prefix "${HOME}/Library/Application Support/Librarian") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.librariand.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Application Support") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/Application Support/Librarian") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.ubd") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.librariand") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.librariand")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/librariand.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb new file mode 100644 index 0000000..d4d54c6 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb @@ -0,0 +1,170 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (literal "/usr/libexec") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/usr/libexec/limitadtrackingd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.AdSheetPhone.management") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AdLib") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/limitadtrackingd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb new file mode 100644 index 0000000..4343b3c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb @@ -0,0 +1,347 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/run/lockdown") + (literal "/dev/urandom") + (literal "/usr/libexec") + (literal "/private/var/run/lockdown.sock") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/Applications/Preferences.app") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/AppleInternal/Lockdown") + (literal "/usr/libexec/lockdownd") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/root/Library/Lockdown") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${FRONT_USER_HOME}/Media") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/Developer") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/logs") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/preferences/SystemConfiguration") + (literal "/dev/random") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/db/launchd.db/com.apple.launchd/overrides.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]mobile[.]lockdownd[.]plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Notes") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Calendar") + (vnode-type DIRECTORY)) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.WebAppCache") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath "/private/var/tmp/MediaCache") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Voicemail") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Applications") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/containers") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Containers") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Media") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/run/lockdown") + (subpath "/private/var/logs") + (subpath "/private/var/root/Library/Lockdown") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/lockdown.sock") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]mobile[.]lockdownd[.]plist") + (subpath-prefix "${FRONT_USER_HOME}/Media") + (subpath "/private/var/preferences/SystemConfiguration") + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (literal "/private/var/db/timezone") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleEffaceableStorageUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "AppleNANDFTLUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-set-properties + (iokit-property "auto-boot")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.AOSNotification") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.notification_proxy") + (global-name "com.apple.mobile.installation_proxy") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.syslog_relay") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.atc2") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.crash_mover") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.mobile.insecure_notification_proxy") + (global-name "com.apple.ait.client") + (global-name "com.apple.webinspector") + (global-name "com.apple.xpcd") + (global-name "com.apple.mobile.assertion_agent") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.lsd.open") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.streaming_zip_conduit") + (global-name "com.apple.symptomsd") + (global-name-regex #"^lockdown[.]") + (global-name "com.apple.afcd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.crashreportcopymobile") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.atc") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/run/lockdown")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockbot") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.purplebuddy") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lockdownd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb new file mode 100644 index 0000000..660e72f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb @@ -0,0 +1,293 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreservices.useractivityd.plist") + (subpath-prefix "${HOME}/Library/Logs/Handoff") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath-prefix "${HOME}/Library/Logs/useractivityd") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreservices.useractivityd.dynamicuseractivites.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Logs/Transport") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/Transport") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath-prefix "${HOME}/Library/Logs/Handoff") + (subpath-prefix "${HOME}/Library/Logs/useractivityd") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreservices.useractivityd.dynamicuseractivites.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreservices.useractivityd.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.open") + (global-name "com.apple.xpcd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.awdd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coreservices.useractivityd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.Sharing") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coreservices.useractivityd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb.xml new file mode 100644 index 0000000..4627e68 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/lsuseractivityd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb new file mode 100644 index 0000000..29a0adc --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb @@ -0,0 +1,131 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (literal "/dev/dtracehelper") + (literal "/Library/Managed Preferences") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/Managed Preferences/mobile") + (literal "/private/var/Managed Preferences/mobile/com.apple.mDNSResponder.plist") + (literal "/dev/null") + (literal "/dev/urandom") + (literal "/private/var/Library/Preferences/") + (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds/" #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds$") + (literal "/dev/random") + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/" #"^/private/var/folders/[^/]+/[^/]+/C/mds$") + (literal "/dev/zero") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/db/dyld")))) +(allow file-read-data + (literal "/private/var/db/crls/crlcache.db") + (subpath "/private/var/tmp/mds") + (subpath "/private/var/db/mds") + (literal "/Library/Keychains/System.keychain") + (require-all + (require-not (regex #"^/Library/Keychains/")) + (require-any + (literal "/usr/sbin") + (literal "/usr/sbin/mDNSResponder") + (regex #"^/Library/Preferences/[.]GlobalPreferences[.]" #"^/Library/Preferences/ByHost/[.]GlobalPreferences[.]") + (literal "/private/etc") + (literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.nat.plist") + (literal "/dev/console") + (literal "/Library/Preferences/com.apple.crypto.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/Library/Preferences/com.apple.mDNSResponder.plist") + (literal "/private/etc/hosts") + (literal "/Library/Preferences/SystemConfiguration/preferences.plist") + (regex #"^/Library/Preferences/com[.]apple[.]security[.]") + (literal "/Library/Security/Trust Settings/Admin.plist")))) +(allow file-read-metadata) +(allow file-write* + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (literal "/private/var/run/mDNSResponder") + (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds/" #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds$") + (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/" #"^/private/var/folders/[^/]+/[^/]+/C/mds$") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/console") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero")) +(allow iokit-open + (iokit-user-client-class "NVEthernetUserClientMDNS") + (iokit-user-client-class "mDNSOffloadUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "wlDNSOffloadUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.awdd") + (global-name "com.apple.bsd.dirhelper") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.snhelper") + (global-name "com.apple.ocspd") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SecurityServer") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreservices.quarantine-resolver") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.system.logger") + (global-name "com.apple.awacs") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications.2") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.webcontentfilter.dns") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.blued")) +(allow mach-register + (global-name "com.apple.d2d.ipc")) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb.xml new file mode 100644 index 0000000..fdb457a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mDNSResponder.sb.xml @@ -0,0 +1,52 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb new file mode 100644 index 0000000..5e3f9ea --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb @@ -0,0 +1,612 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (subpath "/private/var/db/timezone") + (subpath "/Library/Audio/Tunings/Generic/AU") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoProcessing.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Media/Memories/MediaAnalysis") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaanalysis.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/usr/local/lib") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaanalysis.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoProcessing.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Memories/MediaAnalysis") + (subpath "/private/var/tmp") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (literal-prefix "${HOME}/Media/Memories") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.open") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.xpc.activity.unmanaged") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.xpcd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.mediaanalysis")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaanalysisd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb new file mode 100644 index 0000000..bbcc4f0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb @@ -0,0 +1,852 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.rtcreporting.upload") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/mediaserverd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.settings.bluetooth.audio-route.plist") + (subpath-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") + (subpath "/Library") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/AppleInternal/Library/Conference/Environments.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.bag.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (subpath "/private/var/wireless/Library/Logs/awd") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.rtcreporting.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (extension "com.apple.mediaserverd.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${HOME}/Library/Logs/AirPlay.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoConference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences-sounds.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/local/share/firmware/isp") + (extension "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Media/Downloads") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/logs/mediaserverd") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.audio.virtualaudio.plist") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (subpath-prefix "${HOME}/Media/Podcasts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.backedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.celestial.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VideoProcessing.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (subpath-prefix "${HOME}/Media/PhotoData/Sync") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.audio.penguin.plist") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (subpath-prefix "${HOME}/Media/PhotoData/Mutations") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (subpath-prefix "${HOME}/Media/PhotoData/OutboundSharingTmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/usr/local/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Music") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/null") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]mediaserverd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-data + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Downloads") + (subpath-prefix "${HOME}/Media/PhotoData/Mutations") + (literal-prefix "${HOME}/Library/Logs/AirPlay.log") + (subpath-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (subpath-prefix "${HOME}/Media/Podcasts") + (subpath-prefix "${HOME}/Media/iTunes_Control/Music") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") + (extension "com.apple.mediaserverd.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Media/PhotoData/OutboundSharingTmp") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.celestial.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") + (subpath-prefix "${HOME}/Media/PhotoData/Sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.audio.penguin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voicetrigger.notbackedup.plist") + (subpath "/private/var/logs/mediaserverd") + (subpath "/private/var/wireless/Library/Logs/awd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.audio.virtualaudio.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.imessage.bag.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.airplay.plist") + (extension "com.apple.mediaserverd.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facetime.bag.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]mediaserverd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]mediaserverd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]mediaserverd$") + (subpath-prefix "${HOME}"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CoreMotion")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAudio2DeviceUserClient") + (iokit-user-client-class "com_apple_audio_IOBorealisOwlUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleD5500UserClient") + (iokit-user-client-class "AppleVXD375UserClient") + (iokit-user-client-class "IOAccelContext2") + (iokit-user-client-class "AppleH2CamInUserClient") + (iokit-user-client-class "AppleVXE380UserClient") + (iokit-user-client-class "IOReportUserClient") + (iokit-user-client-class "AppleVXD390UserClient") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "AppleH4CamInUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleVXD393UserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleH6CamInUserClient") + (iokit-user-client-class "H3H264VideoEncoderDriverUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleSPUHIDDriverUserClient") + (iokit-user-client-class "IOAccessoryManagerUserClient") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "AppleSRSDriverUserClient") + (iokit-user-client-class "IOAudioCodecsUserClient") + (iokit-user-client-class "AppleH3CamInUserClient") + (iokit-user-client-class "AppleUSBHostInterfaceUserClient") + (iokit-user-client-class "AppleAVEUserClient") + (iokit-user-client-class "IOAudio2TransformerUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOStreamAudioUserClient") + (iokit-user-client-class "IOUSBDeviceInterfaceUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOHIDLibUserClient")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name-regex #"^stack-logs") + (ipc-posix-name-regex #"^OA-") + (ipc-posix-name "shm_pcm_audio_acl") + (ipc-posix-name-regex #"^AppleAURemoteIO[.]." #"^AppleAURemoteIO[.].+") + (ipc-posix-name "shm_pcm_audio_sco_write") + (ipc-posix-name-regex #"^[0-9A-F][0-9A-F]:+[0-9A-F][0-9A-F]-tacl$") + (ipc-posix-name-regex #"^shm_notif[.][^.]+[.][RW]$") + (ipc-posix-name-regex #"^com[.]apple[.]audio[.]abl[.]") + (ipc-posix-name-regex #"^AppleAudioQueue[.]." #"^AppleAudioQueue[.].+") + (ipc-posix-name "shm_pcm_audio_sco_read") + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (ipc-posix-name-regex #"^/FSM-")) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.virtualdisplayserver") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.commcenter.xpc") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.iTunesStore.daemon.deatchwatch") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.marco") + (global-name "com.apple.iTunesStore.daemon-notifications") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.iap2d.distributednotification.server") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.iTunesStore.daemon") + (global-name "com.apple.symptomsd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.GSSCred") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.iap2d.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.b184_monitord") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.networkd") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.apsd") + (global-name "com.apple.carkit.service") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.securekeyvaultd") + (global-name "com.apple.lskdd") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.iapd.distributednotification.server") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.iapd.xpc") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.NetworkLinkConditioner") + (global-name "com.apple.iaptransportd.xpc") + (global-name "com.apple.lskdmsed") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.pegasus") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.filesystems.userfsd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.audio.AUPBRegistrar") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.internal.mediaserverdtracerd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.b184_mcu_commd") + (global-name "com.apple.xpcd") + (global-name "com.apple.ExternalAccessory.distributednotification.server") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow mach-register + (global-name "com.apple.midiserver.io") + (global-name-regex #"^com[.]apple[.]coremedia[.]") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (remote udp "*:*") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.audio.penguin") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.audio.virtualaudio") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.da") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.voicetrigger.notbackedup") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.coremedia.bag") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.settings.bluetooth.audio-route") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.facetime") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.coremedia.bag") + (preference-domain "com.apple.voicetrigger.notbackedup") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.audio.virtualaudio") + (preference-domain "com.apple.facetime") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.audio.penguin") + (preference-domain "com.apple.imessage.bag")) +(allow process-exec* + (literal "/usr/sbin/mediaserverd") + (require-all + (literal "/usr/bin/syslog") + (debug-mode)) + (require-all + (literal "/usr/bin/trace") + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb.xml new file mode 100644 index 0000000..889d903 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mediaserverd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb new file mode 100644 index 0000000..3f50028 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb @@ -0,0 +1,435 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal "/private/etc/master.passwd") + (literal "/dev/random") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.afc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/usr/libexec/mobile_house_arrest") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-data + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/GeoJSON$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/GeoJSON$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobile-house-arrest.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb new file mode 100644 index 0000000..ae1cfc5 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb @@ -0,0 +1,507 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.assets.read") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") + (subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") + (subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets") + (subpath "/private/var/MobileAsset")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal "/usr/libexec/mobileassetd") + (literal "/usr/libexec") + (regex #"^/private/var/root/Library/Cookies$" #"^/private/var/root/Library/Cookies/Cookies[.]binarycookies") + (literal "/") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/MobileAsset") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/ptmx") + (literal "/private/var/root/Library/Preferences/com.apple.WebFoundation.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AssetCacheLocator.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") + (subpath "/AppleInternal/Library/PreinstalledAssets") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/dev/random") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]MobileAsset[.]plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+") + (subpath-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (regex #"^/private/var/root/Library/Caches/mobileassetd/" #"^/private/var/root/Library/Caches/mobileassetd$") + (regex #"^/private/var/root/Library/Cookies$" #"^/private/var/root/Library/Cookies/Cookies[.]binarycookies") + (subpath "/private/var/MobileAsset") + (subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets") + (regex #"^/private/var/root/Library/Preferences/com[.]apple[.]MobileAsset[.]plist") + (subpath "/private/var/tmp") + (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/mobileassetd/" #"^/private/var/mobile/Library/Caches/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+") + (subpath-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd/" #"^/private/var/root/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/mobileassetd$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.cache_delete") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.AssetCacheLocator") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb.xml new file mode 100644 index 0000000..feb0495 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/mobileassetd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb new file mode 100644 index 0000000..0a12bdf --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb @@ -0,0 +1,422 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMailKitClient.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/random") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Library/NanoMailKit") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMail.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMailKitClient.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Library/NanoMailKit") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nanomaild$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.da") + (preference-domain "com.apple.NanoMailKitClient") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.NanoMail") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMailKitClient")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomaild.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb new file mode 100644 index 0000000..2519f06 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb @@ -0,0 +1,616 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.companionsync.plist") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/random") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/null") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Maps$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.Maps.SpringBoard") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.marco") + (global-name "com.apple.Maps.gsEvents") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.Maps.IPC") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.routined.registration") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.marco") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MapsSupport")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapscd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb new file mode 100644 index 0000000..7bfa8ea --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb @@ -0,0 +1,543 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapsgd.log") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Maps") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath "/Developer") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath "/Applications/NanoMaps.app") + (literal-prefix "${HOME}/Library/MapsHistory.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMaps.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.companionsync.plist") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/null") + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Maps") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapsgd.log") + (literal-prefix "${HOME}/Library/MapsHistory.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoMaps.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]NanoMaps$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]NanoMaps$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.marco") + (global-name "com.apple.system.logger") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.geod") + (global-name "com.apple.awdd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.NanoMaps") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.NanoMaps")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nanomapsgd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb new file mode 100644 index 0000000..cd3fc63 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb @@ -0,0 +1,532 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/null") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]MapsSupport" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]MapsSupport" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]MapsSupport") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapsSupport.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]MapsSupport" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]MapsSupport" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]MapsSupport") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]MapsSupport$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.geod") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.routined.registration") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lsd") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.apsd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.securityd") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/navd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb new file mode 100644 index 0000000..56d89a0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb @@ -0,0 +1,296 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.lsd") + (global-name "com.apple.xpcd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb.xml new file mode 100644 index 0000000..bc9a832 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/network-filter.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb new file mode 100644 index 0000000..05f9ca0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb @@ -0,0 +1,314 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.awd.plist") + (subpath "/System/Library") + (literal "/dev/tty.stockholm") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Duet.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/usr/libexec/nfcd") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/nfcd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/NearField" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.awd.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/nfcd.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/NearField" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write-data + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "AppleStockholmControlUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleSSEUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.xpcd") + (global-name "com.apple.lsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.coreduetd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.awdd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (control-name "com.apple.uart.stockholm") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.Duet") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "nfcd") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.stockholm") + (preference-domain "nfcd") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket + (socket-domain AF_SYSTEM)) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nfcd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb new file mode 100644 index 0000000..4a4afac --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb @@ -0,0 +1,68 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.pfd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb.xml new file mode 100644 index 0000000..c8ed3bf --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nlcd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb new file mode 100644 index 0000000..600155c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb @@ -0,0 +1,6 @@ +(version 1) +(allow default) +(deny network* + (local ip "*:*")) +(deny network-outbound + (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb.xml new file mode 100644 index 0000000..fa56c88 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nointernet.sb.xml @@ -0,0 +1,20 @@ + + + + + + + + + +]> + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb new file mode 100644 index 0000000..8cea1cd --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb @@ -0,0 +1,569 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (require-not (subpath "/private/var/logs/MobileLibraryLogs")) + (require-not (subpath "/private/var/logs/MobileMediaFactoryLogs")) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}/Media/Downloads") + (literal "/usr/libexec") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Duet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath "/private/var/tmp") + (literal "/usr/libexec/nsurlsessiond") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nsurlsessiond.plist") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.coremedia")) + (require-any + (literal "/dev/random") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/null") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (subpath "/private/var/logs/MobileLibraryLogs")) + (require-not (subpath "/private/var/logs/MobileMediaFactoryLogs")) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Media/Downloads") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nsurlsessiond.plist") + (subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]nsurlsessiond$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}"))))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.securityd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.ocspd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.awdd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.coremedia.assetdownloader") + (global-name "com.apple.trustd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (require-not (global-name "com.apple.CARenderServer")) + (require-any + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.logger") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.Duet") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nsurlsessiond") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.nsurlsessiond")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlsessiond.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb new file mode 100644 index 0000000..679836f --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb @@ -0,0 +1,384 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nsurlstoraged.plist") + (literal-prefix "${HOME}/Containers") + (subpath "/usr/libexec") + (literal-prefix "${HOME}") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Applications") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal "/dev/random") + (extension "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/containers") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.nsurlstorage.extension-cache") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nsurlstoraged.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.open") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.securityd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.trustd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nsurlstoraged") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.nsurlstoraged")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/nsurlstoraged.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb new file mode 100644 index 0000000..2ce04df --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb @@ -0,0 +1,304 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (literal "/dev/urandom") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/etc/master.passwd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/private/var/MobileDevice") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/MobileDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAESAcceleratorUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.open") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote ip "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/online-auth-agent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb new file mode 100644 index 0000000..1e7ab80 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb @@ -0,0 +1,786 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.biometrickitd.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Passbook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath-prefix "${HOME}/Library/Passes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/random") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AdLib.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/PassKit") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.passd.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.LocalAuthentication.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal "/dev/null") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ConfigServer.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]passd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]passd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]passd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.passd.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Passbook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/kCFPreferencesAnyApplication.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Passes") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath-prefix "${HOME}/Library/Caches/PassKit") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]passd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]passd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]passd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]passd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient")) +(allow iokit-set-properties + (iokit-property "reportStatusMessages")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.geod") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.securityd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.seld.tsmmanager") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.springboard.services") + (global-name "com.apple.cookied") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.nehelper") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.seld") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nfcd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.trustd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (require-not (global-name "com.apple.pluginkit.pkd")) + (require-any + (global-name "com.apple.AdSheetPhone.analytics") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.passes.usage") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.securityd") + (global-name "com.apple.icloud.findmydeviced") + (global-name "com.apple.cloudd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.FSEvents") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.symptomsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.tccd") + (global-name "com.apple.aggregated") + (global-name "com.apple.coremedia.sandboxserver") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.system.logger") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.apsd") + (global-name "com.apple.springboard.carditemscontroller") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.bird.token") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.pegasus") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.passd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Passbook") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.biometrickitd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.LocalAuthentication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.Passbook") + (preference-domain "com.apple.passd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb.xml new file mode 100644 index 0000000..b8d494e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/passd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb new file mode 100644 index 0000000..a2d5429 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb @@ -0,0 +1,160 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/pfm") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal "/dev/pfm") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write-data + (literal "/dev/pfm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/dev/random") + (literal "/dev/urandom") + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/pfd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb new file mode 100644 index 0000000..35e4d9c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb @@ -0,0 +1,459 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/com.apple.printd") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.printd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/run/printd") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/run/printd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.printd.plist") + (subpath-prefix "${HOME}/Library/com.apple.printd") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]printd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]printd$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.springboard.services") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.aggregated") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.nehelper") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.lsd.advertisingidentifiers") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "platform-application"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (remote tcp "*:*") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.printd") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.printd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/printd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb new file mode 100644 index 0000000..154e16e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb @@ -0,0 +1,239 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (regex #"^/private/var/mobile" #"^/private/var/euser[0-9]+") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ImageCaptureFramework.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.mobileslideshow")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb.xml new file mode 100644 index 0000000..7f2c4ab --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/ptpd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb new file mode 100644 index 0000000..70f9b81 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb @@ -0,0 +1,1151 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath "/private/var/tmp/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/tmp") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.medialibrary.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.quicklook.quicklookd.plist") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.homesharing.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/AppleInternal/Library/Frameworks/TypologyRecording.framework") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.quicklook.readonly") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (subpath "/usr/lib") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (subpath "/private/var/tmp/MediaCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.keyboard.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/Library/Dictionaries") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebKit.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (subpath-prefix "${HOME}/Media/Safari") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.IconsCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.preferences.sounds.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.SpeakSelection.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]quicklook[.]quicklookd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.aggregated.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MapKit.internal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreMotion.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iapd.plist") + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.assistant.support.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mt.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreanimation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.da.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (subpath-prefix "${HOME}/Library/VoiceServices/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath-prefix "${HOME}/Library/Dictionaries") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.telephonyutilities.dialassist.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.voiceservices.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataAccess.BehaviorOptions.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.videos.plist") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.InputModePreferences.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebUI.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/null") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.VoiceOverTouch.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/containers/Data/System/com.apple.ondemandd/Library/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd[.]plist" #"^/private/var/mobile/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com[.]apple[.]quicklook[.]quicklookd-.*[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches")) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.quicklook.quicklookd.plist") + (subpath "/private/var/tmp/MediaCache") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/WebKit") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.youtubeframework.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (subpath-prefix "${HOME}/Media/Safari") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.EmojiPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Preferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal-prefix-regex "${HOME}/Library/Preferences/com[.]apple[.]quicklook[.]quicklookd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaaccessibility.public.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Keyboard/LocalDictionary") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState/" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/mobile/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings$" #"^/private/var/euser[0-9]+/Documents/com[.]apple[.]quicklook[.]quicklookd[.]settings/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/mobile/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd-" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd/" #"^/private/var/euser[0-9]+/Library/Caches/Snapshots/com[.]apple[.]quicklook[.]quicklookd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState" #"^/private/var/euser[0-9]+/Library/Saved Application State/com[.]apple[.]quicklook[.]quicklookd[.]savedState") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write-data + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") + (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") + (literal-prefix "${HOME}/Library/WebKit/LocalStorage/StorageTracker.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOAccelDevice2") + (iokit-user-client-class "IOAccelSharedUserClient2") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOAccelContext") + (iokit-user-client-class "IOAccelSharedUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOAccelDevice") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOAccelSubmitter2") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOAccelContext2")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.mediaserverd") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.calaccessd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.coremedia.mutablecomposition") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.pegasus") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.usernotification.notificationscheduler") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coremedia.asset") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.networkd")) + (require-any + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.WebBookmarks.webbookmarksd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.UIKit.KeyboardManagement") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.frontboard.workspace") + (global-name "com.apple.UIKit.statusbarserver") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.FileProvider") + (global-name "com.apple.backboard.animation-fence-arbiter") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.marco") + (global-name "com.apple.UIKit.pasteboardd") + (global-name "ScripterServer") + (global-name "com.apple.librariand") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "UIASTNotificationCenter") + (global-name "com.apple.UIKit.KeyboardManagement.hosted") + (global-name "com.apple.symptomsd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.uikit.GestureServer") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.webfilterd") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.assertiond.extension") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.TextInput.lexicon-server") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.airplaydiagnostics.server") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.TextInput") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.TextInput.rdt") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ondemandd.client") + (local-name-regex #"^com[.]apple[.]assistant[.]contextprovider[.]") + (global-name "com.apple.aggregated") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.assistant.dictation") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.gpumemd.source") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.TextInput.shortcuts") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.dictationd.recognition") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.accessibility.gax.backboard") + (global-name "com.apple.backboard.TouchDeliveryPolicyServer") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.voiceservices.keepalive") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.webinspector") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.fig.movie") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.cvmsServ") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.audio.AURemoteIOServer") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.sharingd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/printd") + (literal "/private/var/run/syslog") + (control-name "com.apple.network.statistics") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.MapKit.internal") + (preference-domain "com.apple.voiceservices") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.WebKit") + (preference-domain ".GlobalPreferences") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.SpeakSelection") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebUI") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.quicklook.quicklookd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.quicklook.quicklookd") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.PeoplePicker")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb.xml new file mode 100644 index 0000000..c3c699a --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/quicklookd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb new file mode 100644 index 0000000..1289c17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb @@ -0,0 +1,120 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") + (subpath "/private/etc/racoon") + (subpath "/private/var/run/racoon") + (literal "/dev/dtracehelper") + (literal "/private/etc/master.passwd")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/random") + (literal "/dev/urandom") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/dtracehelper") + (subpath "/private/var/root") + (literal "/Library/Managed Preferences/mobile") + (literal "/private/var/db/icu") + (literal "/private/var/run/racoon.sock") + (literal "/private/etc/master.passwd") + (subpath "/usr/share") + (subpath "/private/etc/racoon") + (literal "/private/var/run/racoon.pid") + (subpath "/private/var/preferences") + (literal "/dev/null") + (subpath "/private/var/run/racoon") + (literal "/dev/zero") + (literal "/Library/Preferences") + (subpath "/private/var/db/timezone") + (literal "/private/var/log/racoon.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/Library/Managed Preferences") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/sbin") + (subpath "/usr/share"))) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (literal "/etc") + (literal "/tmp") + (literal "/var") + (literal "/private/etc/localtime")) +(allow file-write* + (literal "/private/var/run/racoon.sock") + (literal "/private/var/run/racoon.pid") + (literal "/private/var/log/racoon.log") + (require-all + (regex #"^/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/zero") + (literal "/dev/dtracehelper") + (literal "/dev/null")) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^apple[.]shm[.]cfprefsd[.]")) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.securityd") + (global-name "com.apple.system.logger") + (global-name "com.apple.nehelper") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.ocspd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (local-name "com.apple.cfprefsd.agent")) +(allow network* + (local udp "*:500") + (local udp "*:4500") + (remote udp "*:*") + (literal "/private/var/run/racoon.sock")) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (control-name "com.apple.net.ipsec_control") + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb.xml new file mode 100644 index 0000000..7c41e08 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/racoon.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb new file mode 100644 index 0000000..5bab0d0 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb @@ -0,0 +1,355 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/Applications") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/usr/libexec") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/containers/Bundle/Application") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.pegasus") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.xpcd") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.logger") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.virtualdisplaysession") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ctkd.token-client") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.system.libinfo.muser") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/replayd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb new file mode 100644 index 0000000..d2c4918 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb @@ -0,0 +1,197 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreSuggestions.MobileAssets.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.webinspector") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.suggestions") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/reversetemplated.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb new file mode 100644 index 0000000..6babb37 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb @@ -0,0 +1,271 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.revisiond.staging") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.revisiond.revision") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (subpath "/private/var/log/com.apple.revisiond") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.FSEvents") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.revisiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-fsctl + (fsctl-command (_IO "h" 13)) + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 30))) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb.xml new file mode 100644 index 0000000..e93d2bb --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/revisiond.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb new file mode 100644 index 0000000..e679cb7 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb @@ -0,0 +1,654 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (subpath "/Applications") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/usr/libexec") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-journal") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/System") + (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.]routined[.]plist") + (literal "/usr/libexec/routined") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/com.apple.routined") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-shm") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-wal") + (subpath "/Developer") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath "/Library/Audio/Plug-Ins") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath-prefix "${HOME}/Library/Assets") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.routined.plist") + (require-all + (subpath "/AppleInternal/Library") + (debug-mode)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/aes_0") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/ptmx") + (literal "/dev/null") + (literal "/dev/zero") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}"))))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.routined.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Logs/com.apple.routined") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.]routined[.]plist") + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-journal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") + (subpath "/private/var/tmp") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]routined$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.securityd") + (global-name "com.apple.tccd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.marco") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.symptomsd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.navigationListener") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.lsd.open") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.calaccessd") + (global-name "com.apple.Maps.mapspushd") + (global-name "com.apple.passd.usage") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.carkit.service") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.lsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.locationd.routine") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:443") + (remote tcp "*:80") + (literal "/private/var/run/syslog") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.netsrc") + (control-name "com.apple.network.statistics")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.routined") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.routined") + (preference-domain "com.apple.PeoplePicker")) +(allow process-exec* + (literal "/usr/bin/ditto")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb.xml new file mode 100644 index 0000000..49a8a1b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/routined.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb new file mode 100644 index 0000000..4b18125 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb @@ -0,0 +1,547 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/usr/libexec") + (literal "/dev/null") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/usr/libexec/seld") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.awd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.passbook.plist") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.tsmreg.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.seld.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/NearField" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]seld" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]seld" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]seld") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.seld.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.tsmreg.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.stockholm.awd.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]seld" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]seld" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]seld") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]seld$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/NearField" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleSSEUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleCredentialManagerUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nfcd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.cookied") + (global-name "com.apple.networkd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.apsd") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.system.logger") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nehelper") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.trustd") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.awdd") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged"))) +(allow mach-register + (global-name "com.apple.seld.aps") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.passbook") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.seld") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.stockholm.tsmreg") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.seld") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.stockholm")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/seld.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb new file mode 100644 index 0000000..1de1fc5 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb @@ -0,0 +1,895 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (subpath-prefix "${HOME}/Media/Debug") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Photos") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read"))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/System/Library") + (literal "/usr/libexec") + (subpath-prefix "${HOME}/Media/Debug") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.UIKit.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilenotes.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (subpath "/AppleInternal/Applications/Sharing.app") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.iokit.IOMobileGraphicsFamily.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Library/Notes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (extension "com.apple.sharing.airdrop.readonly") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (subpath "/Developer") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.sharingd.plist") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Library/Ringtones") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.eventkit.plist") + (subpath-prefix "${HOME}/Media/Recordings") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/mobile/Library/UserConfigurationProfiles/EffectiveUserSettings.plist$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/EffectiveUserSettings.plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/tmp") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.marco.plist") + (literal "/dev/dtracehelper") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.ids.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.conference.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]sharingd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]sharingd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]sharingd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (literal-prefix "${HOME}/Downloads") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Media") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Downloads")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Sharing.plist") + (subpath-prefix "${HOME}/Media/Memories") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Debug") + (subpath-prefix "${HOME}/Media/Photos") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.sharingd.plist") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath "/private/var/tmp") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]sharingd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]sharingd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]sharingd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]sharingd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath "/private/var/.DocumentRevisions-V100/staging") + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Media/Memories"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Downloads"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-flags + (literal-prefix "${HOME}/Downloads")) +(allow file-write-mode + (literal-prefix "${HOME}/Downloads") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.marco") + (global-name "com.apple.librariand") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.fig.movie") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.MediaRemote.isrunning") + (global-name "com.apple.calaccessd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.MediaRemote.nowplayingserver") + (global-name "com.apple.bulletinboard.settingsconnection") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.apsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.bird.token") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.passd.assertions") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.voicememod.xpc") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.bird") + (global-name "com.apple.pegasus") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.MediaRemote.daemon") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.passd.library") + (global-name "com.apple.awdd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.network.statistics") + (literal "/private/var/run/syslog") + (remote udp "*:*") + (remote tcp "*:*") + (control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.eventkit") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.sharingd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.sharingd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/sharingd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb new file mode 100644 index 0000000..589f253 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb @@ -0,0 +1,821 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.logging.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Social") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.tencentweibo.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weibo.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.vimeo.xpc.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (subpath-prefix "${HOME}/Media/Purchases") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.demo-settings.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.camera.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.flickr.xpc.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.NanoRegistry.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.twitter.xpc.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.pairedsync.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facebook.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.nanoprefsyncd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp") + (subpath "/Developer") + (subpath "/Library/Ringtones") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.springboard.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.twitterd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileslideshow.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/usr/share") + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData/Metadata") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-journal") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-shm") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (subpath-prefix "${HOME}/Library/FairPlay")) + (require-not (literal "/usr/sbin/fairplayd")) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/zero") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite-wal") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Media") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Media/PhotoData/Thumbnails") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.twitter.xpc.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.twitterd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.vimeo.xpc.plist") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.facebook.xpc.plist") + (subpath-prefix "${HOME}/Library/Social") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.tencentweibo.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.weibo.xpc.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.flickr.xpc.plist") + (subpath "/private/var/tmp") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]facebook[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]flickr[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]tencentweibo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]twitter[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]vimeo[.]xpc$" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]weibo[.]xpc$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]((((f(acebook|lickr)|tencentweibo)|twitter)|vimeo)|weibo)[.]xpc$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pairedsyncd.syncstate") + (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.tccd") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.nanomaps.xpc.GeoServices") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.GSSCred") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.fig.movie") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.geod") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.pegasus") + (global-name "com.apple.networkd") + (global-name "com.apple.lsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.videocompositor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application") + (require-entitlement "com.apple.authkit.client.private"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coremedia.remaker") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.assetimagegenerator") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.capturesource") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.recorder") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.coremedia.asset") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.NanoRegistry") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.weibo.xpc") + (preference-domain "com.apple.pairedsync") + (preference-domain "com.apple.CoreDuet") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.flickr.xpc") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.facebook.xpc") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.tencentweibo.xpc") + (preference-domain "com.apple.twitter.xpc") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.vimeo.xpc") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.itunesstored") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.tencentweibo.xpc") + (preference-domain "com.apple.twitter.xpc") + (preference-domain "com.apple.facebook.xpc") + (preference-domain "com.apple.vimeo.xpc") + (preference-domain "com.apple.weibo.xpc") + (preference-domain "com.apple.flickr.xpc")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/social-services.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb new file mode 100644 index 0000000..b90ab2d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb @@ -0,0 +1,222 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/System/Library") + (subpath "/private/var/db/UpdateMetrics") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileSoftwareUpdate.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/MobileSoftwareUpdate") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/MobileSoftwareUpdate")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") + (subpath "/private/var/db/UpdateMetrics") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/OTAUpdate-") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/MobileSoftwareUpdate")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-set-properties + (iokit-property "IONVRAM-DELETE-PROPERTY")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.MobileSoftwareUpdate") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/softwareupdated.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb new file mode 100644 index 0000000..3a4aa8c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb @@ -0,0 +1,367 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.StreamingUnzipService.plist") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (literal "/usr/libexec/streaming_zip_conduit") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (literal "/dev/random") + (literal "/dev/urandom") + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.lsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.xpcd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.lockdown.host_watcher") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/streaming_zip_conduit.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb new file mode 100644 index 0000000..a266fa6 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath-prefix "${HOME}/Library/studentd") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.Accessibility.plist") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.avfoundation.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobileipod.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.studentd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (literal-prefix "${HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.corevideo.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coreaudio.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.itunesstored.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.locationd.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/Safari") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.GEO.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.coremedia.plist") + (literal "/dev/random") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mediaremote.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Classroom.app") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/studentd") + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.studentd.plist") + (subpath "/private/var/tmp") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal-prefix "${HOME}/Library/Safari/Bookmarks.db") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.SystemConfiguration.SCNetworkReachability") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.tccd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.coremedia.capturesource") + (global-name "com.apple.coremedia.asset") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.cfnetwork.AuthBrokerAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.SystemConfiguration.helper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GSSCred") + (global-name "com.apple.springboard.services") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cookied") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cfnetwork.cfnetworkagent") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.capturesession") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nehelper") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.DNSConfiguration") + (global-name "com.apple.usernotification.notificationregistrar") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.SystemConfiguration.NetworkInformation") + (global-name "com.apple.lsd.open") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.lsd") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.coremedia.assetimagegenerator") + (global-name "com.apple.coremedia.videocompositor") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.usernotification.notificationscheduler") + (global-name "com.apple.securityd") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.logind.client.machService") + (global-name "com.apple.lsd.icons") + (global-name "com.apple.pegasus") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.coremedia.recorder") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.SystemConfiguration.PPPController") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.system.logger") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.nsurlstorage-cache") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.coremedia.remaker") + (global-name "com.apple.xpcd") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "platform-application"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd_privileged")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.studentd") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coremedia") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.corevideo") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.studentd")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/studentd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb new file mode 100644 index 0000000..b1fe990 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb @@ -0,0 +1,310 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.MobileAsset.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Suggestions") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreSuggestions.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.CoreSuggestions.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.mobilecal.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.message.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreSuggestions.MobileAssets.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Suggestions") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.suggestions.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (subpath-prefix "${HOME}/Library/Calendar") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreSuggestions.plist") + (subpath "/private/var/tmp") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.syncdefaultsd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd") + (global-name "com.apple.securityd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.reversetemplated") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.calaccessd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.message") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.CoreSuggestions") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.CoreSuggestions") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.suggestions")) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/suggestd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb new file mode 100644 index 0000000..a67682e --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb @@ -0,0 +1,416 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal-prefix "${HOME}/Library/Caches") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.accountsd.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/SyncedPreferences") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebFoundation.plist") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.appleaccount.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/null") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]syncdefaultsd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles$" #"^/private/var/mobile/Library/ConfigurationProfiles/" #"^/private/var/mobile/Library/UserConfigurationProfiles$" #"^/private/var/mobile/Library/UserConfigurationProfiles/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-not (literal-prefix "${HOME}/Library/")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection") + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/Managed Preferences/mobile") + (subpath-prefix "${HOME}/Library/SyncedPreferences") + (subpath-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") + (subpath "/private/var/tmp") + (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/com[.]apple[.]syncdefaultsd" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/com[.]apple[.]syncdefaultsd") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]syncdefaultsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/SyncedPreferences$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb.xml new file mode 100644 index 0000000..ce5746c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syncdefaultsd.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb new file mode 100644 index 0000000..43a1e55 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb @@ -0,0 +1,135 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (vnode-type REGULAR-FILE) + (file-mode #o0001))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-priv-task-port) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb.xml new file mode 100644 index 0000000..c45fc8b --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/syslog_relay.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb new file mode 100644 index 0000000..da7dd71 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb @@ -0,0 +1,131 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/Developer") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/private/etc/master.passwd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/test-common.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb new file mode 100644 index 0000000..8560e1c --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb @@ -0,0 +1,83 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/")) + (subpath "/private/var/spool/mdt") + (literal-prefix "${HOME}/Library/Application Support") + (subpath-prefix "${HOME}/Library/Application Support/Containers") + (subpath-prefix "${HOME}/Library/Inboxes") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")) + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox") + (subpath-prefix "${HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-not (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal")) + (require-not (require-entitlement "com.apple.coreduetd.people")))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Downloads") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/transitd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb new file mode 100644 index 0000000..1d90015 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb @@ -0,0 +1,344 @@ +(version 1) +(deny default) +(allow file-ioctl + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfs_helper$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (regex #"^/dev/disk[0-9]+" #"^/dev/rdisk[0-9]+") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfs_helper.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb new file mode 100644 index 0000000..73c6b66 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb @@ -0,0 +1,386 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/urandom") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/random") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (regex #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/mobile/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd/" #"^/private/var/euser[0-9]+/Library/Caches/com[.]apple[.]nsurlsessiond/Downloads/com[.]apple[.]userfsd$") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.filesystems.userfs_helper") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/System/Library/Filesystems/exfat.fs/Contents/Resources/fsck_exfat") + (literal "/System/Library/Filesystems/msdos.fs/Contents/Resources/fsck_msdos")) +(allow process-fork) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb.xml new file mode 100644 index 0000000..78d5266 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/userfsd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb new file mode 100644 index 0000000..badad35 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow file-map-executable) +(allow file-read* + (subpath "/System/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.public.notbackedup.plist") + (literal "/dev/random") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AOSNotification.public.notbackedup.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Media/Vibrations") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/tmp") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.CoreDuet.plist") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.DataMigration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.AppSupport.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var") + (literal-prefix "${HOME}/Media") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/com.apple.itunes.lock_sync") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.PeoplePicker.plist") + (subpath "/private/var/tmp") + (subpath-prefix "${HOME}/Media/Vibrations") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Media/Vibrations") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.tccd") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.CoreDuet") + (preference-domain "com.apple.icloud.findmydeviced.postwipe") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.icloud.findmydeviced.public.notbackedup") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb.xml new file mode 100644 index 0000000..c9d9909 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vibrationmanagerd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb new file mode 100644 index 0000000..fd5e662 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb @@ -0,0 +1,417 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/urandom") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/zero") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/share") + (literal "/dev/random") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.app-sandbox.read") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-not (subpath "/private/var/logs")) + (require-not (regex #"^/private/var/mobile/Library" #"^/private/var/euser[0-9]+/Library")) + (require-not (subpath "/private/var/tmp")) + (require-not (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers")) + (require-not (subpath "/private/var/containers"))) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[-0-9A-Z]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow iokit-get-properties) +(allow ipc-posix-sem) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name-regex #"^com[.]f5[.]f5_sslvpn_plugin") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb.xml new file mode 100644 index 0000000..e1b6e67 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/vpn-plugins.sb.xml @@ -0,0 +1,53 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb new file mode 100644 index 0000000..6386892 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb @@ -0,0 +1,251 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.webinspectord.plist") + (subpath "/Applications") + (literal "/usr/libexec") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (literal "/dev/dtracehelper") + (literal "/dev/zero") + (subpath "/usr/share") + (literal "/dev/random") + (literal "/private/var/tmp/webinspectord.log") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.WebInspector.plist") + (subpath "/System") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/urandom") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/dev/ptmx") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/aes_0") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$")) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal/Applications") + (subpath "/private/var/mobile/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/tmp/webinspectord.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.WebInspector") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.webinspectord") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb.xml new file mode 100644 index 0000000..defba17 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/webinspectord.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb new file mode 100644 index 0000000..90586af --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb @@ -0,0 +1,217 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/random") + (subpath "/AppleInternal") + (literal "/dev/urandom") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.sandbox.executable") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/dev/null") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/zero") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") + (subpath "/usr/share") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (require-all + (subpath-prefix "${HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.].+[.]plist$") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (literal "/private/etc/group") + (literal "/private/etc/passwd") + (literal "/") + (literal "/private/etc/protocols") + (literal "/private/etc/services") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.bulletinboard.plist") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/ConfigurationProfiles/PublicInfo/" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo$" #"^/private/var/mobile/Library/UserConfigurationProfiles/PublicInfo/" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo$" #"^/private/var/euser[0-9]+/Library/(User)?ConfigurationProfiles/PublicInfo/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-read-metadata) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.send")) + (require-all + (require-not (literal "/dev/random")) + (require-not (literal "/dev/urandom")) + (require-any + (literal "/dev/dtracehelper") + (literal "/dev/null") + (literal "/dev/zero") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (regex #"^/dev/ttyp[0-9a-f]$" #"^/dev/ptyp[0-9a-f]$"))) +(allow file-write-mode + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.private.safe-move.receive"))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleBCMWLANUserClient")) +(allow iokit-get-properties) +(allow mach-bootstrap) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lsd.open") + (global-name "com.apple.cfprefsd.daemon") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd") + (global-name "com.apple.lsd.advertisingidentifiers") + (global-name "com.apple.tccd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") + (global-name "com.apple.ctkd.token-client") + (global-name "com.apple.system.logger") + (global-name "com.apple.corecaptured") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.xpcd") + (global-name "com.apple.CoreAuthentication.daemon.libxpc") + (global-name "com.apple.assertiond.processassertionconnection") + (global-name "com.apple.duetknowledged.activity") + (global-name "com.apple.lsd.openurl") + (global-name "com.apple.managedconfiguration.profiled.public") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.appsupport.cplogd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.icons") + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-listpids) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow process-info-dirtycontrol) +(allow process-info-rusage) +(allow pseudo-tty) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb.xml b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb.xml new file mode 100644 index 0000000..e8f1774 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/rev_profiles/wifiFirmwareLoader.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone5__1_9.3_13E237/references/sandbox_bundle b/tests/iPhone5__1_9.3_13E237/references/sandbox_bundle new file mode 100644 index 0000000..61b6772 Binary files /dev/null and b/tests/iPhone5__1_9.3_13E237/references/sandbox_bundle differ diff --git a/tests/iPhone5__1_9.3_13E237/references/sandbox_profiles.txt b/tests/iPhone5__1_9.3_13E237/references/sandbox_profiles.txt new file mode 100644 index 0000000..22a0812 --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/sandbox_profiles.txt @@ -0,0 +1,121 @@ +AGXCompilerService +AdSheet +AirTraffic +BTServer +BlueTool +CFNetworkAgent +CVMServer +CommCenter +DataActivation +EscrowSecurityAlert +IDSCredentialsAgent +IDSRemoteURLConnectionAgent +IMDPersistenceAgent +IMRemoteURLConnectionAgent +IMTranscoderAgent +Lowtide +MTLCompilerService +MailCompositionService +MobileBackup +MobileCal +MobileMaps +MobileSlideShow +PasteBoard +SafariSafeBrowsing +ScreenshotService +StreamingUnzipService +WebSheet +accessoryd +afcd +appconduitd +apsd +assertiond +cloudphotod +com.apple.AssetCacheLocatorService +com.apple.GSSCred +com.apple.WebKit.Databases +com.apple.WebKit.Networking +com.apple.WebKit.WebContent +com.apple.assistant.assistantd +com.apple.bird +com.apple.cloudd +com.apple.datadetectors.AddToRecentsService +com.apple.homed +com.apple.nehelper +com.apple.nesessionmanager +com.apple.quicklook.QLThumbnailsService +com.apple.rtcreportingd +com.apple.sandboxd +com.apple.siri.ClientFlow.ClientScripter +com.apple.snhelper +com.apple.tccd +com.apple.tzlinkd +com.apple.ubd +container +containermanagerd +coresymbolicationd +cplogd +dataaccessd +debugserver +deleted +duetexpertd +findmydeviced +fmfd +ftp-proxy-embedded +gamed +geocorrectiond +geod +gizmoappd +gputoolsd +healthd +iapd +identityservicesd +itunesstored +keyboard +librariand +limitadtrackingd +lockdownd +lsuseractivityd +mDNSResponder +mediaanalysisd +mediaserverd +mobile-house-arrest +mobileassetd +nanomaild +nanomapscd +nanomapsgd +navd +network-filter +nfcd +nlcd +nointernet +nsurlsessiond +nsurlstoraged +online-auth-agent +passd +pfd +printd +ptpd +quicklookd +racoon +replayd +reversetemplated +revisiond +routined +seld +sharingd +social-services +softwareupdated +streaming_zip_conduit +studentd +suggestd +syncdefaultsd +syslog_relay +test-common +transitd +userfs_helper +userfsd +vibrationmanagerd +vpn-plugins +webinspectord +wifiFirmwareLoader diff --git a/tests/iPhone5__1_9.3_13E237/references/sb_ops b/tests/iPhone5__1_9.3_13E237/references/sb_ops new file mode 100644 index 0000000..053e56d --- /dev/null +++ b/tests/iPhone5__1_9.3_13E237/references/sb_ops @@ -0,0 +1,125 @@ +default +appleevent-send +authorization-right-obtain +device* +device-camera +device-microphone +distributed-notification-post +file* +file-chroot +file-ioctl +file-issue-extension +file-link +file-map-executable +file-mknod +file-mount +file-mount-update +file-read* +file-read-data +file-read-metadata +file-read-xattr +file-revoke +file-search +file-unmount +file-write* +file-write-create +file-write-data +file-write-flags +file-write-mode +file-write-owner +file-write-setugid +file-write-times +file-write-unlink +file-write-xattr +generic-issue-extension +qtn-user +qtn-download +qtn-sandbox +hid-control +iokit* +iokit-issue-extension +iokit-open +iokit-set-properties +iokit-get-properties +ipc* +ipc-posix* +ipc-posix-issue-extension +ipc-posix-sem +ipc-posix-shm* +ipc-posix-shm-read* +ipc-posix-shm-read-data +ipc-posix-shm-read-metadata +ipc-posix-shm-write* +ipc-posix-shm-write-create +ipc-posix-shm-write-data +ipc-posix-shm-write-unlink +ipc-sysv* +ipc-sysv-msg +ipc-sysv-sem +ipc-sysv-shm +job-creation +load-unsigned-code +lsopen +mach* +mach-bootstrap +mach-cross-domain-lookup +mach-host* +mach-host-exception-port-set +mach-host-special-port-set +mach-issue-extension +mach-lookup +mach-per-user-lookup +mach-priv* +mach-priv-host-port +mach-priv-task-port +mach-register +mach-task-name +network* +network-inbound +network-bind +network-outbound +nvram* +nvram-delete +nvram-get +nvram-set +user-preference* +user-preference-read +user-preference-write +process* +process-exec* +process-exec-interpreter +process-fork +process-info* +process-info-listpids +process-info-pidinfo +process-info-pidfdinfo +process-info-pidfileportinfo +process-info-setcontrol +process-info-dirtycontrol +process-info-rusage +pseudo-tty +signal +sysctl* +sysctl-read +sysctl-write +system* +system-acct +system-audit +system-chud +system-debug +system-fsctl +system-info +system-kext* +system-kext-load +system-kext-unload +system-kext-query +system-mac-label +system-nfssvc +system-privilege +system-reboot +system-sched +system-set-time +system-socket +system-suspend-resume +system-swap +system-write-bootstrap diff --git a/tests/iPhone6__2_11.0.0_15A372/inputs/sandbox.kext b/tests/iPhone6__2_11.0.0_15A372/inputs/sandbox.kext new file mode 100644 index 0000000..40c5c7f Binary files /dev/null and b/tests/iPhone6__2_11.0.0_15A372/inputs/sandbox.kext differ diff --git a/tests/iPhone6__2_11.0.0_15A372/logs/.dummy b/tests/iPhone6__2_11.0.0_15A372/logs/.dummy new file mode 100644 index 0000000..e69de29 diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AGXCompilerService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AGXCompilerService.sb new file mode 100644 index 0000000..39f57ad --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AGXCompilerService.sb @@ -0,0 +1,692 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper")) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/System/Library") + (subpath "/Developer") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode))) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (subpath "/System/Library/Extensions") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]")) + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-"))) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name "apple.cfprefs.")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow mach-task-name + (target self)) +(allow network-outbound + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl* + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (sysctl-name "vm.footprint_suspend") + (debug-mode))) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AGXCompilerService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AGXCompilerService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AGXCompilerService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb new file mode 100644 index 0000000..61c72ba --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb @@ -0,0 +1,1591 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.quicklook.readonly") + (extension-class "com.apple.app-sandbox.read") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone"))) +(allow file-link + (require-all + (require-not (subpath-prefix "${HOME}/Library/AddressBook")) + (require-any + (require-not (subpath-prefix "${HOME}/Media")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.sandbox.executable") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal-prefix "${HOME}/Library/Cookies") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath "/usr/share") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath "/Developer") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/SMS") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${HOME}/Media/Memories") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPad.settings") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPhone.settings")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.AdSheetPad.plist") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.AdSheetPhone.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist") + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$")))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/run/syslog") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/Memories") + (vnode-type SYMLINK) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/run/printd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (literal-prefix "${HOME}/Library/Cookies") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/SMS") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPad.settings") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPhone.settings")) + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches"))))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (require-all + (require-any (iokit-property "interval") +(iokit-property "mode") +(iokit-property "useMag") +(iokit-property "QueueSize")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name "apple.cfprefs.")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.passd.assertions") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.dataaccess.dataaccessd.active") +(global-name "com.apple.passd.in-app-payment")) + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (require-any (global-name "com.apple.eventpump") +(global-name "com.apple.mobilemail.messageuiservices")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 9ba8) + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aaa8 a080 9bb3) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 9ba7) + (global-name "com.apple.cache_delete.public") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.librariand") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contactsd") + (34 a381 a080 9bc0) + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.backboard.display.services") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cache_delete") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.twitterd.server") + (global-name "com.apple.bird.token") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.chatkit.clientcomposeserver.xpc") +(global-name "com.apple.companion.camera") +(global-name "com.apple.coremedia.cameraviewfinder") +(global-name "com.apple.iad.") +(global-name "com.apple.imagent.Embedded.Launched") +(global-name "com.apple.mobile.deleted")) + (global-name "com.apple.mobilemail.services.xpc") + (require-any (global-name "com.apple.WebBookmarks.webbookmarksd") +(global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd")) + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.PowerManagement.control") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (34 aae0 a080 9bbb) + (global-name "com.apple.accountsd.oauthsigner") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.passd.library") + (34 aadc a080 9bba) + (global-name "com.apple.webinspector") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "PurplePPTServer") + (global-name "com.apple.FileProvider") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.logd") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.ait.client") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (34 aad7 a080 9bb9) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled") + (34 ab2e a080 9bc9) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.calaccessd") + (global-name "com.apple.mobilemail") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.dataaccess.dataaccessd") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.global-name")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow mach-register + (local-name "com.apple.accessibility.gax.client") + (local-name "com.apple.assistant.contextprovider.") + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/printd")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (require-any (preference-domain "com.apple.AdSheetPad") +(preference-domain "com.apple.AdSheetPhone") +(preference-domain "com.apple.reminders")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.da") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.youtubeframework") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.InputModePreferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.logging") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.mobileipod") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.WebFoundation") + (require-any (preference-domain "com.apple.AdSheetPad") +(preference-domain "com.apple.AdSheetPhone") +(preference-domain "com.apple.reminders")) + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtubeframework") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-not (sysctl-name "sysctl.proc_native")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-fsctl + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 32))) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket + (socket-domain 39) + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AdSheet.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb new file mode 100644 index 0000000..004c51b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb @@ -0,0 +1,836 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (literal "/private/etc/master.passwd")) + (require-not (literal "/private/var")) + (require-not (literal "/private/var/root")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/private/var/mobile/" #"^/private/var/mobile$" #"^/private/var/euser[0-9]+/" #"^/private/var/euser[0-9]+$" #"^/private/var/[-0-9A-F]+/" #"^/private/var/[-0-9A-F]+$" #"^/private/var/Users/[^/]+/" #"^/private/var/Users/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/PPTDevice") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal "/private/etc/master.passwd")) + (require-not (literal "/private/var")) + (require-not (literal "/private/var/root")) + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (regex #"^/private/var/mobile/" #"^/private/var/mobile$" #"^/private/var/euser[0-9]+/" #"^/private/var/euser[0-9]+$" #"^/private/var/[-0-9A-F]+/" #"^/private/var/[-0-9A-F]+$" #"^/private/var/Users/[^/]+/" #"^/private/var/Users/[^/]+$") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "installcood.f.")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.backupd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cache_delete") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.nanoprefsync") + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.pairedsyncd.progress") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.coremedia.admin") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.voicememod.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/lockdown/checkin") + (literal "/private/var/run/lockdown.sock")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname")))) +(allow system-fsctl + (fsctl-command (_IO "J" 18)) + (fsctl-command (_IO "h" 27)) + (fsctl-command (_IO "h" 29)) + (fsctl-command (_IO "h" 28))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AirTraffic.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb new file mode 100644 index 0000000..7af9d70 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb @@ -0,0 +1,394 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "hw.machine") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/AnnotationKit.MigratorService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb new file mode 100644 index 0000000..3dd2366 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb @@ -0,0 +1,933 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/uart.log")) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Library/AddressBook"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath "/Library/Application Support/BTServer") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") +(literal "/private/var/wireless/Library/CallHistory/call_history.db") +(literal "/private/var/wireless/Library/CallHistory") +(literal "/Library/Application Support/BTServer") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db") +(literal "/") +(subpath-prefix "${HOME}/Library/MobileBluetooth") +(subpath-prefix "${HOME}/Library/Logs/Bluetooth")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/dev/uart.log") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/bluetoothd-" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]bluetoothd-" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?bluetoothd-" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?bluetoothd-" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?bluetoothd-"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/usr/sbin") + (literal "/dev/btwake") + (literal "/usr/sbin/BTServer") + (subpath "/System") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/usr/sbin/BTServer") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal "/usr/sbin") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal "/Library/Preferences") + (require-any (literal "/private/var/wireless") +(literal "/private/var/wireless/Library")) + (literal "/private/var") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter")) +(allow file-test-existence) +(allow file-write* + (require-any (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") +(literal "/private/var/wireless/Library/CallHistory/call_history.db") +(literal "/private/var/wireless/Library/CallHistory") +(literal "/Library/Application Support/BTServer") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db") +(literal "/") +(subpath-prefix "${HOME}/Library/MobileBluetooth") +(subpath-prefix "${HOME}/Library/Logs/Bluetooth")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/hci") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/bluetoothd-" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]bluetoothd-" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?bluetoothd-" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?bluetoothd-" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?bluetoothd-") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/wireless/Library/CallHistory"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/uart.log") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "BTDebugUserClient") +(iokit-user-client-class "IOUserEthernetResourceUserClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleBasebandUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "shm_pcm_audio_sco_write") +(ipc-posix-name "shm_pcm_audio_sco_read")) + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name-regex #"^..:..:..:..:..:..-tacl$") + (require-any (ipc-posix-name "com.apple.bluetooth.magnet.shm") +(ipc-posix-name "shm_notif.tacl.R") +(ipc-posix-name "shm_notif.tacl.W") +(ipc-posix-name "shm_notif.tsco.W") +(ipc-posix-name "shm_notif.tsco.R"))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.BTServer.le") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contactsd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.suggestd.contacts") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.BlueTool") +(global-name "com.apple.BTAudioHALPlugin.xpc") +(global-name "com.apple.BTServer.avrcp") +(global-name "com.apple.BTServer.map") +(global-name "com.apple.BTServer.pbap")) + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MobileInternetSharing") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9806) + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.carkit.service") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.TelephonyUtilities") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.purplebuddy") + (require-any (preference-domain "com.apple.BTServer.airplane") +(preference-domain "com.apple.BTServer") +(preference-domain "com.apple.CoreBluetooth.cloud") +(preference-domain "com.apple.MobileBluetooth.debug") +(preference-domain "com.apple.MobileBluetooth.devices") +(preference-domain "com.apple.MobileBluetooth.ledevices") +(preference-domain "com.apple.MobileBluetooth.services")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.CrashReporter") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.BTServer.airplane") +(preference-domain "com.apple.BTServer") +(preference-domain "com.apple.CoreBluetooth.cloud") +(preference-domain "com.apple.MobileBluetooth.debug") +(preference-domain "com.apple.MobileBluetooth.devices") +(preference-domain "com.apple.MobileBluetooth.ledevices") +(preference-domain "com.apple.MobileBluetooth.services"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.wakereason") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb.xml new file mode 100644 index 0000000..39d099f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BTServer.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb new file mode 100644 index 0000000..7ec97ab --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb @@ -0,0 +1,706 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/AppleInternal") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/usr/sbin") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath "/private/etc/bluetool") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (literal "/dev/btreset") + (literal "/dev/btwake")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.hostname") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/BlueTool.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb new file mode 100644 index 0000000..34fae0d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb @@ -0,0 +1,191 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CFNetworkAgent.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb new file mode 100644 index 0000000..1280e79 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb @@ -0,0 +1,766 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link + (subpath-prefix "${HOME}/Media") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-read* + (debug-mode) + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/Logs") +(subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL") +(subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/Caches") +(subpath-prefix "${FRONT_USER_HOME}/Library/com.apple.nsurlsessiond") +(subpath "/private/var/logs/CrashReporter")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CPL-diagnostics")) + (subpath "/private/var/db/diagnostics") + (subpath "/private/var/db/uuidtext") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs") + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Media")) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (subpath-prefix "${HOME}/Media") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.avasset.read-only"))) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CPL-diagnostics")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Media")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.logd.admin") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cloudphotod") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 95b9) + (global-name "com.apple.photoanalysisd") + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (global-name "com.apple.pegasus") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.mediaserverd") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.endpoint.xpc"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-priv-task-port + (debug-mode)) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia"))) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-exec* + (debug-mode)) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (require-any + (sysctl-name "kern.proc.") + (sysctl-name "vm.footprint_suspend"))) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CPLDiagnose.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb new file mode 100644 index 0000000..ed48cb3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb @@ -0,0 +1,334 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (require-any (subpath "/System/Library/Frameworks/OpenGLES.framework") +(subpath "/usr/bin/codesign_allocate")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.cvmsCompAgent") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-any (subpath "/System/Library/Frameworks/OpenGLES.framework") +(subpath "/usr/bin/codesign_allocate"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CVMServer.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb new file mode 100644 index 0000000..828ebd1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb @@ -0,0 +1,455 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/tmp") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Containers/Bundle/Application") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle/Application") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/tmp") + (subpath "/private/var/tmp/com.apple.LaunchServices.Placeholders") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Containers/Bundle/Application") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.cache_delete") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb new file mode 100644 index 0000000..c9b178a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb @@ -0,0 +1,614 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (require-any (literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/uart.umts") +(literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/cu.debug") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log")) + (subpath "/private/var/wireless")) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (require-any (subpath "/private/var/wireless/Library/Caches/com.apple.CommCenter") +(subpath "/private/var/wireless/Library/Caches/com.apple.coretelephony") +(subpath "/private/var/wireless/Library/Caches/CommCenterClassic")) + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/usr/local/lib/CarrierBundleDevKey.dylib") + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (subpath "/private/var/logs/WirelessLibraryLogs") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.coretelephony") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.coretelephony") +(subpath-prefix "${FRONT_USER_HOME}/Library/LASD") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/private/var/tmp/CSI.scratch") +(literal "/private/var/preferences/AeneasCustomFlags.plist")) + (literal "/dev/ptmx") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/dev") +(literal-prefix "${FRONT_USER_HOME}/Library/SyncedPreferences/com.apple.coretelephony.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.purplebuddy.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (require-any (literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/uart.umts") +(literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/cu.debug") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/dev/uart.log") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (literal "/private/etc/hosts") + (require-not (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/[-0-9A-F]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/Users/[^/]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/[-0-9A-F]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/Users/[^/]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile$" #"^/private/var/mobile/Library$" #"^/private/var/mobile/Library/CallHistory$" #"^/private/var/mobile/Library/Carrier Bundle.bundle$" #"^/private/var/mobile/Library/Operator Bundle.bundle$" #"^/private/var/mobile/Library/Voicemail$" #"^/private/var/mobile/Library/Preferences$" #"^/private/var/euser[0-9]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$" #"^/private/var/[-0-9A-F]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$" #"^/private/var/Users/[^/]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/uart.umts") +(literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/cu.debug") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.coretelephony") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.coretelephony") +(subpath-prefix "${FRONT_USER_HOME}/Library/LASD") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/private/var/tmp/CSI.scratch") +(literal "/private/var/preferences/AeneasCustomFlags.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/logs/WirelessLibraryLogs") + (regex #"^/private/var/logs/CoreTelephonyTrace$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-.+$") + (require-any (literal "/private/var/CommCenter/spool/loading") +(literal "/private/var/logs/CoreTelephonyTraceScratch") +(literal "/private/var/logs/log-bb-live-stats.txt") +(literal "/private/var/preferences/SystemConfiguration/preferences.plist-lock") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist-lock") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist-new") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist") +(literal "/private/var/preferences/csidata.tmp") +(literal "/private/var/preferences/csidata")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/dev/uart.log") + (regex #"^/private/var/logs/CrashReporter/Baseband/log-bb-$" #"^/private/var/logs/CrashReporter/Baseband/log-bb-.+$") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath "/private/var/wireless") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/[-0-9A-F]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/Users/[^/]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/[-0-9A-F]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/Users/[^/]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist") + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist")) +(allow file-write-unlink + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name-regex #"^com[.]apple[.]CoreTelephony[.]LogChannel[.]$" #"^com[.]apple[.]CoreTelephony[.]LogChannel[.][-0-9A-F]+$") + (require-any (global-name "com.apple.CommCenter.lasd") +(global-name "com.apple.CoreTelephony.BasebandStateReport.LogChannel") +(global-name "com.apple.CoreTelephony.powerlog-Full.LogChannel") +(global-name "com.apple.CoreTelephony.powerlog-Lite.LogChannel")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.videoconference_override") +(preference-domain "com.apple.tethering_override") +(preference-domain "com.apple.cellulardataplan") +(preference-domain "com.apple.commcenter")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.TTY") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.apsalerts") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.operator") + (preference-domain "com.apple.MobileSMS") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "net.link.generic.ifdata") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "sysctl.proc_native") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) +(allow system-socket + (socket-domain 39) + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (require-any + (socket-protocol 2) + (socket-protocol 1)))) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb.xml new file mode 100644 index 0000000..ce4ed0d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/CommCenter.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb new file mode 100644 index 0000000..f5d1415 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb @@ -0,0 +1,1006 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/WebClips") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.app-sandbox.read")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension "com.apple.odr-assets") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation") +(subpath-prefix "${HOME}/Documents/com.apple.DataActivation.settings")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (require-any (subpath "/Applications/DataActivation.app") +(subpath "/Applications/MobileSafari.app") +(subpath "/AppleInternal/Library/Safari") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.DataActivation.plist")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/usr/share") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Safari") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Library/Caches/Safari") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") +(literal-prefix "${HOME}/Library/Preferences/.dat") +(literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilemail.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.OTASyncAgent.plist"))) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Safari") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/Safari") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") +(literal-prefix "${HOME}/Library/Preferences/.dat") +(literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation") +(subpath-prefix "${HOME}/Documents/com.apple.DataActivation.settings")) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-all + (require-not (literal-prefix "${HOME}/Library/Mail/AutoFetchEnabled")) + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Mobile Documents"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/asl_input") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/printd") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (require-any (preference-domain "com.apple.DataActivation") +(preference-domain "com.apple.youtube.dp")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.VoiceOverTouch") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.mobilesafari") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.youtubeframework") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.webcontentfilter") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.DataActivation") +(preference-domain "com.apple.youtube.dp")) + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-exec* + (require-any (literal "/Applications/MobileSafari.app/MobileSafari") +(literal "/Applications/DataActivation.app/DataActivation"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb.xml new file mode 100644 index 0000000..9cd646a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/DataActivation.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb new file mode 100644 index 0000000..6a067e3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb @@ -0,0 +1,405 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/EscrowSecurityAlert.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb new file mode 100644 index 0000000..c3132e1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb @@ -0,0 +1,292 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids.IDSCredentialsAgent") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.ids.IDSCredentialsAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSCredentialsAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..3bbc2b2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb @@ -0,0 +1,671 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (literal "/private/var") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.marco") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.facetime.bag") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb new file mode 100644 index 0000000..689a42d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/AddressBook") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS") +(subpath-prefix "${HOME}/Library/Logs/SMSMigrator")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/SMS") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/SMS") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS") +(subpath-prefix "${HOME}/Library/Logs/SMSMigrator")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.contactsd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.search.appindexer") +(global-name "com.apple.searchd") +(global-name "com.apple.suggestd.messages")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/lockdown.sock")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.imdpersistence.IMDPersistenceAgent") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.imdpersistence.IMDPersistenceAgent") + (preference-domain "com.apple.imdsmsrecordstore")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMDPersistenceAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..835997f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb @@ -0,0 +1,663 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}")) + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb new file mode 100644 index 0000000..c6b92ec --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb @@ -0,0 +1,829 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-read* + (subpath-prefix "${HOME}/Media") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.avatar") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.im.transcode") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (subpath-prefix "${HOME}/Library/Caches/com.apple.avatar") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.im.transcode") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aae0 a080 8d36) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mediaserverd") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8d4c) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.coremedia.decompressionsession") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ET") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.MobileSMS") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security") + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.coremedia")))))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "kern.bootsessionuuid") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname")))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/IMTranscoderAgent.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb new file mode 100644 index 0000000..f0086bf --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb @@ -0,0 +1,203 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ImageDecoder.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb new file mode 100644 index 0000000..93cdb31 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library/Extensions") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MTLCompilerService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb new file mode 100644 index 0000000..e2a80ff --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb @@ -0,0 +1,1390 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/AppleInternal/Library/Frameworks") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Media") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/ConfigurationProfiles") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.MailCompositionService.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService") +(subpath-prefix "${HOME}/Documents/com.apple.MailCompositionService.settings")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal "/private/var/run/printd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService") +(subpath-prefix "${HOME}/Documents/com.apple.MailCompositionService.settings")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (34 aad7 a080 8a2a) + (global-name "com.apple.contactsd") + (global-name "com.apple.hangtracerd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 8a03) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (global-name "com.apple.coreduetd") + (local-name "com.apple.assistant.contextprovider.") + (global-name "PurpleSystemEventPort") + (require-any (global-name "com.apple.bulletinboard.utilitiesconnection") +(global-name "com.apple.suggestd.suggestionmanager") +(global-name "com.apple.dataaccess.dataaccessd")) + (local-name "com.apple.iphone.axserver") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aaa8 a080 8a0f) + (global-name "com.apple.bird") + (global-name "com.apple.suggestd.contacts") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 8a04) + (global-name "com.apple.cache_delete.public") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.librariand") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (34 a381 a080 8a21) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.springboard") + (global-name "com.apple.bird.token") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.mobilemail.services.xpc") + (require-any (global-name "com.apple.WebBookmarks.webbookmarksd") +(global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd")) + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.FileProvider") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.PowerManagement.control") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (34 aae0 a080 8a36) + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (34 aadc a080 8a64) + (global-name "com.apple.webinspector") + (global-name "com.apple.springboard.services") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.aggregated") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.logd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 ab2e a080 8a4e) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.audio.AudioComponentRegistrar") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "PurplePPTServer") + (global-name "com.apple.icloud.fmfd") + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.mediastream.sharing") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.global-name")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/printd") + (literal "/private/var/run/lockdown.sock") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.ZoomTouch") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.MailCompositionService") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.preferences.sounds") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.youtubeframework") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.PeoplePicker") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.GEO") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.MailCompositionService") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtubeframework") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (sysctl-name "sysctl.proc_native") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MailCompositionService.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb new file mode 100644 index 0000000..addd126 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb @@ -0,0 +1,12 @@ +(version 1) +(allow default) +(deny file-read* + (subpath "/private/var/run/mobile_image_mounter")) +(deny file-write-setugid + (subpath "/private/var/run/mobile_image_mounter") + (require-not (vnode-type DIRECTORY))) +(deny file-write-unlink + (literal "/private") + (literal "/private/var") + (literal "/private/var/run")) +(deny job-creation) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb.xml new file mode 100644 index 0000000..c2485d3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileBackup.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb new file mode 100644 index 0000000..f308e77 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb @@ -0,0 +1,1381 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/MobileAsset/Assets")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath "/private/var/MobileAsset/Assets")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write")))) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes/iTunes Library.itlp") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/usr/lib") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") +(subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") +(subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") +(subpath-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") +(literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log")) + (subpath-prefix "${HOME}/Library/SMS") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow-") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.camera.settings") +(subpath-prefix "${HOME}/Documents/com.apple.mobileslideshow.settings")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (subpath-prefix "${HOME}/Media/Memories") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.mobileslideshow.plist") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.camera.plist")) + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (regex #"^/private/var/mobile/Containers/$" #"^/private/var/mobile/Containers/.+$" #"^/private/var/euser[0-9]+/Containers/.*$" #"^/private/var/[-0-9A-F]+/Containers/.*$" #"^/private/var/Users/[^/]+/Containers/.*$")) + (require-not (subpath "/private/var/containers")) + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/euser[0-9]+/Library/" #"^/private/var/[-0-9A-F]+/Library/" #"^/private/var/Users/[^/]+/Library/"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist") + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")))) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]" #"^/private/var/[-0-9A-F]+/Media/Pano_[0-9]" #"^/private/var/Users/[^/]+/Media/Pano_[0-9]")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") + (extension "com.apple.tcc.kTCCServiceMediaLibrary"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (literal-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") +(subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") +(subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") +(subpath-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") +(literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log")) + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (subpath-prefix "${HOME}/Library/SMS") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log") + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]" #"^/private/var/[-0-9A-F]+/Media/Pano_[0-9]" #"^/private/var/Users/[^/]+/Media/Pano_[0-9]")))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.mobileipod.plist")) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow-") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.camera.settings") +(subpath-prefix "${HOME}/Documents/com.apple.mobileslideshow.settings")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")))))))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState")) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Caches"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath "/private/var/mnt")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (extension "com.apple.sandbox.application-group")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-"))) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs."))) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow ipc-posix-shm-write-unlink + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (local-name "com.apple.accessibility.gax.client") + (local-name "com.apple.assistant.contextprovider.") + (extension "com.apple.sandbox.application-group") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.app-sandbox.read-write"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.demo-settings") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (preference-domain "com.apple.VoiceOverTouch") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.accountsd") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.ImageCaptureFramework") + (require-any (preference-domain "com.apple.nanocamera") +(preference-domain "com.apple.legacycamera") +(preference-domain "com.apple.videouploadplugins") +(preference-domain "com.apple.youtubeframework.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.da") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.cloud.quota") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.act") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.nanocamera") +(preference-domain "com.apple.legacycamera") +(preference-domain "com.apple.videouploadplugins") +(preference-domain "com.apple.youtubeframework.notbackedup")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileslideshow") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.cloud.quota") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb.xml new file mode 100644 index 0000000..6799460 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/MobileSlideShow.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb new file mode 100644 index 0000000..ae73790 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb @@ -0,0 +1,395 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/preferences/Logging") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath "/private/var/db/timezone") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Developer") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/System/Library/Frameworks/UIKit.framework/Support/pasteboardd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "sysctl.proc_native") + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb.xml new file mode 100644 index 0000000..42afdf5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/PasteBoard.sb.xml @@ -0,0 +1,52 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb new file mode 100644 index 0000000..a02be99 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb @@ -0,0 +1,277 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Safari/History") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/Safari.History.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb new file mode 100644 index 0000000..9a6b409 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb @@ -0,0 +1,462 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.SafariBookmarksSyncAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.SafariBookmarksSyncAgent")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Safari") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.SafariBookmarksSyncAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.SafariBookmarksSyncAgent")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Safari") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.cloudd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.Safari.Support") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.SafariBookmarksSyncAgent") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Safari.Support") + (preference-domain "com.apple.SafariBookmarksSyncAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariBookmarksSyncAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb new file mode 100644 index 0000000..5bc0a81 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb @@ -0,0 +1,358 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.apsd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.SafariCloudHistoryPushAgent") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.SafariCloudHistoryPushAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariCloudHistoryPushAgent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb new file mode 100644 index 0000000..35dd76f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb @@ -0,0 +1,377 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/private/var/db/icu") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.Safari.SafeBrowsing")) + (extension "com.apple.app-sandbox.read") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.Safari.SafeBrowsing")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.usrstack64") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/SafariSafeBrowsing.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb new file mode 100644 index 0000000..bb74e00 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb @@ -0,0 +1,419 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-test-existence) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.pegasus") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.trustd") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networking.captivenetworksupport") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 83a5) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.ScreenSharingViewServiceHelper") +(global-name "com.apple.springboard.statusbarservices")) + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.corevideo") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb.xml new file mode 100644 index 0000000..6351937 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenSharingServer.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb new file mode 100644 index 0000000..1895bee --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb @@ -0,0 +1,364 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ScreenshotService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb new file mode 100644 index 0000000..fe6591f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb @@ -0,0 +1,307 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (extension "com.apple.StreamingUnzipService") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.StreamingUnzipService")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/StreamingUnzipService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb new file mode 100644 index 0000000..0ac247f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb @@ -0,0 +1,275 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb new file mode 100644 index 0000000..9c1c7c1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb @@ -0,0 +1,204 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/private/var/containers/Bundle/Application") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb new file mode 100644 index 0000000..f9ab5c4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb @@ -0,0 +1,1305 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets"))) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.mobilemail.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.OTASyncAgent.plist$")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.WebSheet.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (subpath-prefix "${HOME}/Library/WebClips") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet") +(subpath-prefix "${HOME}/Documents/com.apple.WebSheet.settings")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/FairPlay") +(literal "/usr/sbin/fairplayd")) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (literal-prefix "${HOME}/Library") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-not (regex #"^/private/var/mobile/Library/Mail/AutoFetchEnabled$" #"^/private/var/euser[0-9]+/Library/Mail/AutoFetchEnabled$" #"^/private/var/[-0-9A-F]+/Library/Mail/AutoFetchEnabled$" #"^/private/var/Users/[^/]+/Library/Mail/AutoFetchEnabled$")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState/") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet") +(subpath-prefix "${HOME}/Documents/com.apple.WebSheet.settings")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases") +(subpath-prefix "${HOME}/Library/WebKit/LocalStorage")) + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.certui.relay") + (global-name "com.apple.CARenderServer") + (34 aad7 a080 8052) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.hangtracerd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 80ad) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aaa8 a080 8041) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.mobilesafari-settings") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 80a5) + (global-name "com.apple.cache_delete.public") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.CoreAuthentication.daemon") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.librariand") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contactsd") + (require-any (global-name "com.apple.eventpump") +(global-name "com.apple.mobilemail.messageuiservices")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.bird.token") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.mobilemail.services.xpc") + (require-any (global-name "com.apple.WebBookmarks.webbookmarksd") +(global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd")) + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.FileProvider") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.audio.AudioSession") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (34 aae0 a080 805d) + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (34 aadc a080 803b) + (global-name "com.apple.webinspector") + (global-name "com.apple.analyticsd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.parsecd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.nanoprefsync") + (34 a381 a080 8042) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled") + (34 ab2e a080 8051) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.assertiond.expiration") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.mobilemail") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.global-name")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.camera") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.ZoomTouch") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.preferences.sounds") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.InputModePreferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.WebSheet") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.youtubeframework") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-exec* + (literal "/Applications/WebSheet.app/WebSheet")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/WebSheet.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb new file mode 100644 index 0000000..0de9a6d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb @@ -0,0 +1,663 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/accessoryd") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/CrashReporter/accessoryd") + (require-any (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (require-any (iokit-user-client-class "AppleAuthCPUserClient") +(iokit-user-client-class "AppleUSBHostDeviceUserClient") +(iokit-user-client-class "IOAccessoryEAInterfaceUserClient") +(iokit-user-client-class "IOAccessoryPortUserClient")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "AppleUSBHostInterfaceUserClient") +(iokit-user-client-class "IOAccessoryManagerUserClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (require-all + (require-any (iokit-property "Authenticated") +(iokit-property "InterfaceProperties")) + (iokit-user-client-class "IOUSBHostDevice")) + (require-all + (require-any (iokit-property "PowerState") +(iokit-property "VirtualMode")) + (iokit-user-client-class "IODPController"))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (require-any (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+"))) +(allow network-inbound + (local udp "*:*")) +(allow network-bind + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$"))) +(allow network-outbound + (remote udp "*:*") + (remote tcp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.accessoryd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.TelephonyUtilities") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carplay") + (preference-domain "com.apple.PeoplePicker") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd")) + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.accessoryd") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.videos") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd"))) +(allow process-exec* + (require-any (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iap2d") +(literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iapd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-kext-load + (require-any (kext-bundle-id "com.apple.driver.usb.cdc.ecm") +(kext-bundle-id "com.apple.driver.usb.cdc.ncm") +(kext-bundle-id "com.apple.driver.usb.cdc") +(kext-bundle-id "com.apple.driver.usb.IOUSBHostHIDDevice") +(kext-bundle-id "com.apple.driver.usb.networking") +(kext-bundle-id "com.apple.driver.AppleUSBDeviceAudioController") +(kext-bundle-id "com.apple.driver.AppleUSBAudio"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb.xml new file mode 100644 index 0000000..9cd646a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accessoryd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb new file mode 100644 index 0000000..96f76da --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb @@ -0,0 +1,605 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/usr/local/bin") + (literal "/usr/libexec/fmfd") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced") + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (literal "/usr/local/bin/accounts_tool") +(literal "/usr/libexec/fmflocatord") +(literal "/usr/libexec/locationd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Accounts") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/usr/libexec/findmydeviced") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.accountsd") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Accounts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.accountsd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.accountsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.accountsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties + (iokit-property "IORegistryEntryPropertyKeys")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.passd.library") + (global-name "com.apple.securityd") + (global-name "com.apple.SafariBookmarksSyncAgent") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.awdd") + (global-name "com.apple.dataaccess.dataaccessd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info-codesignature) +(allow process-info-rusage + (require-entitlement "com.apple.security.exception.process-info")) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb.xml new file mode 100644 index 0000000..9c28723 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/accountsd.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb new file mode 100644 index 0000000..0274c8b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb @@ -0,0 +1,417 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-journal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-shm") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-wal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (regex #"/private/var/containers/Bundle/Application/[^/]+/News.app/MCRestrictions.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.cloudd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow user-preference-read + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.AdLib") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.AdLib")) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb.xml new file mode 100644 index 0000000..fbc7162 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/adtrackingd.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb new file mode 100644 index 0000000..e6657c9 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb @@ -0,0 +1,680 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension "com.apple.afc.root") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (require-any (literal "/AFCDEBUG") +(literal "/usr/libexec/afcd")) + (literal "/usr/libexec") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.afc.root") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/Library/Preferences/SystemConfiguration") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/Library/Preferences") + (extension "com.apple.app-sandbox.read") + (literal "/private") + (literal "/private/var") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.afc.root") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.FileCoordination") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.xpchelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/lockdown/checkin")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.afc") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.maxvnodes") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/afcd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb new file mode 100644 index 0000000..ea5151f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb @@ -0,0 +1,438 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/preferences/Logging") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/Library/CoreAnalytics") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/db/analyticsd") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Analytics-" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Analytics-" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?Analytics-" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?Analytics-" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?Analytics-"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter")) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/db/analyticsd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Analytics-" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Analytics-" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?Analytics-" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?Analytics-" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?Analytics-") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties + (require-all + (iokit-property "product-id") + (iokit-user-client-class "IOPlatformDevice"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow user-preference-read + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GEO") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb.xml new file mode 100644 index 0000000..9c28723 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/analyticsd.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb new file mode 100644 index 0000000..45c1d19 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb @@ -0,0 +1,537 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.mediaserverd.read") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.mediaserverd.read") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/Developer") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileipod") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appaudiod.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb new file mode 100644 index 0000000..89e1ff6 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb @@ -0,0 +1,627 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Library/AppConduit") +(subpath-prefix "${HOME}/Library/Logs/AirTraffic") +(subpath-prefix "${HOME}/Library/Logs/AppConduit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle/Application") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/MobileIdentityData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/AppConduit") +(subpath-prefix "${HOME}/Library/Logs/AirTraffic") +(subpath-prefix "${HOME}/Library/Logs/AppConduit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.atc.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.misagent") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.cache_delete") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobile.installd") + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.pairedsyncd") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/appconduitd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb new file mode 100644 index 0000000..ae19f17 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb @@ -0,0 +1,510 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") +(subpath-prefix "${HOME}/Library/ApplePushService")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (literal "/dev/aes_0") + (subpath "/usr/share") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Preferences") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/System/Library/CoreServices/SystemVersion$" #"^/System/Library/CoreServices/SystemVersion.+$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/private/etc") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plistLibrary/Keychains") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plistusr") +(literal "/private/") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}") +(subpath-prefix "${HOME}/Library/Managed Preferences")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/Library/Preferences") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/Managed Preferences/mobile") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Logs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/Keychains") + (require-any (subpath "/private/var/preferences") +(literal "/Library/Managed Preferences/mobile")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") +(subpath-prefix "${HOME}/Library/ApplePushService")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-inbound + (literal "/")) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/ApplePushService.framework/apsd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "sysctl.proc_native") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb.xml new file mode 100644 index 0000000..ce4ed0d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/apsd.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb new file mode 100644 index 0000000..4803828 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb @@ -0,0 +1,426 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (literal "/usr/libexec") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/containers/Bundle") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/System/Library") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/Developer") + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.spindump") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-task-name) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.assertiond") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.assertiond")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow sysctl* + (require-any (sysctl-name "kern.ipc.throttle_best_effort") +(sysctl-name "kern.memorystatus_vm_pressure_send"))) +(allow sysctl-read + (require-any (sysctl-name "hw.targettype") +(sysctl-name "kern.max_task_pmem")) + (require-any (sysctl-name "kern.ipc.throttle_best_effort") +(sysctl-name "kern.memorystatus_vm_pressure_send")) + (extension "com.apple.security.exception.sysctl.read-only") + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb.xml new file mode 100644 index 0000000..f2e83c7 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assertiond.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb new file mode 100644 index 0000000..8c70ad0 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb @@ -0,0 +1,968 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.sharing.airdrop.readonly")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.avasset.read-only") + (require-any + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoData"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.sandbox.executable")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assetsd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assetsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/Memories") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.assetsd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assetsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assetsd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AGXCommandQueue") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXGLContext") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AGXSharedUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.CloudPhotoDerivativeGenerator") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.securityd") + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.cloudphotod") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.photoanalysisd") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.mediastream.sharing") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.demo-settings") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.assetsd") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.assetsd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileslideshow") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "kern.proc.all") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb.xml new file mode 100644 index 0000000..d06b1e5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/assetsd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb new file mode 100644 index 0000000..3449ef4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb @@ -0,0 +1,577 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.BarcodeSupport.Notification") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.BarcodeSupport.Notification")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.BarcodeSupport.Notification")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.BarcodeSupport.Notification") + (subpath-prefix "${HOME}/Library/Caches/com.apple.BarcodeSupport.Notification") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.BarcodeSupport.Notification")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.BarcodeSupport.Notification")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.calaccessd") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_notification.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb new file mode 100644 index 0000000..ccd3667 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb @@ -0,0 +1,51 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/barcode_parser.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb new file mode 100644 index 0000000..eb5bb03 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb @@ -0,0 +1,798 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/")))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/BulletinDistributor") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored/BulletinImageCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (literal "/usr/libexec")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/BulletinDistributor") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.bulletinboard.observerconnection") +(global-name "com.apple.companionappd.pingsubscriber")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.sysdiagnose.service.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 771a) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.pairedsyncd.progress") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.awdd") + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.bulletindistributor") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.mobileipod") + (require-any (preference-domain "bulletindistributord") +(preference-domain "com.apple.sysdiagnose")) + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.bulletindistributor")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/bulletindistributord.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb new file mode 100644 index 0000000..72c405d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb @@ -0,0 +1,156 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-not (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/")) + (subpath "/Developer") + (require-not (extension "com.apple.sandbox.executable"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/System/Library") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow mach-cross-domain-lookup) +(allow process-info-codesignature) +(allow process-info-pidinfo) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb.xml new file mode 100644 index 0000000..4d996cb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/closured.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb new file mode 100644 index 0000000..90dec87 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb @@ -0,0 +1,23 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-map-executable) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb.xml new file mode 100644 index 0000000..54e3d99 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cloudphotod.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb new file mode 100644 index 0000000..7438b1a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb @@ -0,0 +1,640 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/preferences/SystemConfiguration/NetworkInterfaces.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.AssetCacheC") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-bind + (local udp "*:*")) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:53")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AssetCacheLocatorService") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.AssetCacheTetherator") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb new file mode 100644 index 0000000..c0ac93f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb @@ -0,0 +1,275 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/db/heim-credential-store.archive") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (literal "/private/var/db/heim-credential-store.archive") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.GSSCred.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb new file mode 100644 index 0000000..70436bc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb @@ -0,0 +1,232 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "vm.footprint_suspend") + (sysctl-name "hw.availcpu") + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname")))) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb.xml new file mode 100644 index 0000000..58c58e4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Databases.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb new file mode 100644 index 0000000..a5f757f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb @@ -0,0 +1,429 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-test-existence) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.ocspd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network* + (local udp "*:*") + (local tcp "*:*") + (remote tcp "*:*") + (remote udp "*:*")) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "vm.footprint_suspend") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (extension "com.apple.security.exception.sysctl.read-only") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (sysctl-name "hw.availcpu") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb.xml new file mode 100644 index 0000000..58c58e4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.Networking.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb new file mode 100644 index 0000000..6007a41 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb @@ -0,0 +1,1234 @@ +(version 1) +(deny default) +(allow device-camera + (extension "com.apple.webkit.camera")) +(allow device-microphone + (extension "com.apple.webkit.microphone")) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension "com.apple.odr-assets") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/Library/CoreMediaIO/Plug-Ins/DAL") + (extension "com.apple.webkit.camera")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.app-sandbox.read") + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (require-not (xattr "com.apple.security.private.")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-not (vnode-type SYMLINK)) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (vnode-type SYMLINK)) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (require-not (xattr "com.apple.security.private.")) + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.analyticsd") + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 7397) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aaa8 a080 73a2) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.FileProvider") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 73df) + (global-name "com.apple.cache_delete.public") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.compressionsession") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.locationd.synchronous") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.bird.token") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (34 aae0 a080 73b0) + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.webinspector") + (global-name "com.apple.securityd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 73af) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.sharingd.nsxpc") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (34 ab2e a080 73ae) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.audio.audiohald") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.awdd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.app-sandbox.mach") + (extension "com.apple.webkit.camera")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.da") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.voiceservices.logging") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (require-any (preference-domain "com.apple.LaunchServices") +(preference-domain "com.apple.avfoundation.videoperformancehud")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.InputModePreferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "vm.footprint_suspend") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-only") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (sysctl-name "hw.availcpu") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml new file mode 100644 index 0000000..58c58e4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb new file mode 100644 index 0000000..eec1bcc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb @@ -0,0 +1,811 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Info.plist" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+/Info.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath-prefix "${HOME}/Library/Assistant") +(literal-prefix "${HOME}/Library/Caches/com.apple.siri.")) + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/local/lib") + (subpath "/usr/lib") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${HOME}/siri_recordings") +(subpath "/Library/Audio/Tunings")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Assistant") +(literal-prefix "${HOME}/Library/Caches/com.apple.siri.")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.contactsd") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.BTLEAudioController.xpc") +(global-name "com.apple.assistant_service")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (global-name "com.apple.accountsd.oauthsigner") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.awdd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.WebFoundation") + (require-any (preference-domain "com.apple.AssistantServices") +(preference-domain "com.apple.assistant.token") +(preference-domain "com.apple.siri.backedup.encrypted") +(preference-domain "com.apple.weather")) + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation.avvc") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.AssistantServices") +(preference-domain "com.apple.assistant.token") +(preference-domain "com.apple.siri.backedup.encrypted") +(preference-domain "com.apple.weather")) + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.assistant.logging")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb.xml new file mode 100644 index 0000000..d06b1e5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.assistant.assistantd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb new file mode 100644 index 0000000..3a63301 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb @@ -0,0 +1,920 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.clouddocs.version") + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs") + (extension-class "com.apple.quicklook.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents/")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.librarian.ubiquity-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.quicklook.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.bird") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.bird") +(literal-prefix "${PROCESS_TEMP_DIR}/com.apple.bird") +(subpath-prefix "${HOME}/Library/Application Support/CloudDocs") +(subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(literal-prefix "${HOME}/Library/Mobile Documents.") +(subpath-prefix "${HOME}/Library/Logs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") +(literal-prefix "${HOME}/Library/")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.bird") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.bird") +(literal-prefix "${PROCESS_TEMP_DIR}/com.apple.bird") +(subpath-prefix "${HOME}/Library/Application Support/CloudDocs") +(subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(literal-prefix "${HOME}/Library/Mobile Documents.") +(subpath-prefix "${HOME}/Library/Logs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") +(literal-prefix "${HOME}/Library/")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Application Support") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.ubd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.installation") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.FSEvents") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.revisiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cache_delete") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.and.xpc") +(global-name "com.apple.bird.ContainerMetadataExtractor")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.coresymbolicationd") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.mmcs") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.bird") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.iCloudDriveApp") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.iCloudDriveApp")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30))) +(allow system-info + (info-type "hw.uuid")) +(allow system-package-check) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb.xml new file mode 100644 index 0000000..f81a4a2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.bird.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb new file mode 100644 index 0000000..73e1e0b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb @@ -0,0 +1,160 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/usr/libexec/captiveagent") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.captiveagent.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb new file mode 100644 index 0000000..2a626a4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb @@ -0,0 +1,800 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (regex #"/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #".+/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (regex #"^/private/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/[-0-9A-F]+/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/Users/[^/]+/Library/Caches/CloudKit/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (subpath "/.TemporaryItems") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/private/var/logs/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/Ubiquity") +(literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") +(subpath-prefix "${HOME}/Library/Logs/awd")) + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/CloudKit") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.cloudd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.cloudd")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/CloudKit"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal "/private/var/logs/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/Ubiquity") +(literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") +(subpath-prefix "${HOME}/Library/Logs/awd")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Caches/CloudKit") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/.TemporaryItems") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.cloudd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.cloudd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/CloudKit") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_com.apple.cloudd") + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (require-all + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "FNetwork.defaultStorageSession") + (ipc-posix-name "com.apple.AppleDatabaseChanged") + (ipc-posix-name-regex #"^/tmp/com[.]apple[.]csseed[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.datamigrator") + (global-name "com.apple.hangtracerd") + (require-any (global-name "com.apple.SecurityServer") +(global-name "com.apple.coreservices.quarantine-resolver")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.contactsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.CoreServices.coreservicesd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.fairplayd") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.awdd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.cdp.daemon") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7007) + (require-any (global-name "com.apple.protectedcloudstorage.protectedcloudkeysyncing") +(global-name "com.apple.windowserver.active")) + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.ocspd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.springboard") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.purplebuddy")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.cloudd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb new file mode 100644 index 0000000..e6a459a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb @@ -0,0 +1,375 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.mobilephone") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.message") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb new file mode 100644 index 0000000..e86b258 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb @@ -0,0 +1,1115 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-entitlement "com.apple.private.librarian.container-proxy") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-link + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit")) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/homed_") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.Home") +(subpath-prefix "${HOME}/Library/HomeConfiguration") +(subpath-prefix "${HOME}/Library/homed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.homed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.homed")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (literal-prefix "${HOME}/Library") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/DeviceRegistry") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/homed_") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.Home") +(subpath-prefix "${HOME}/Library/HomeConfiguration") +(subpath-prefix "${HOME}/Library/homed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.homed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.homed")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.contactsd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.system.logger") + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.revisiond") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.sysdiagnose.service.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.bird.token") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.FileProvider") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.PairingManager") +(global-name "com.apple.assistant.security") +(global-name "com.apple.corefollowup.agent") +(global-name "com.apple.coremedia.endpointpicker.xpc") +(global-name "com.apple.coremedia.endpointremotecontrolsession.xpc")) + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nehelper") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (34 a381 a080 6d53) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.awdd") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow" + (require-any + (global-name "com.apple.coreduetd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.homed") +(preference-domain "com.apple.Home.ControlCenter") +(preference-domain "com.apple.avfoundation.frecents")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.coreanimation") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.homed") +(preference-domain "com.apple.Home.ControlCenter") +(preference-domain "com.apple.avfoundation.frecents")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaremote") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.homed.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb new file mode 100644 index 0000000..fa9c78d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb @@ -0,0 +1,810 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (extension "com.apple.app-sandbox.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/dev/ptmx") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (regex #"^/private/var/preferences/com[.]apple[.]networkd[.]plist" #"^/private/var/preferences/com[.]apple[.]networkd[.][-0-9A-Z_a-z]+[.]plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/containers/Bundle/Application") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (literal "/private/var/preferences/Logging/Subsystems/com.apple.network.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.networkextension.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.][-0-9A-Z_a-z]+[.]plist") + (regex #"^/private/var/Managed Preferences/mobile/com[.]apple[.]networkd[.]plist" #"^/private/var/Managed Preferences/mobile/com[.]apple[.]networkd[.][-0-9A-Z_a-z]+[.]plist") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (require-any (subpath "/usr/local/bin") +(literal "/usr/bin/DumpBasebandCrash")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (require-any (literal "/private/var/preferences/Logging/Subsystems/com.apple.network.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.networkextension.plist")) + (regex #"^/private/var/preferences/com[.]apple[.]networkd[.]plist" #"^/private/var/preferences/com[.]apple[.]networkd[.][-0-9A-Z_a-z]+[.]plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/preferences/com[.]apple[.]networkextension[.]plist" #"^/private/var/preferences/com[.]apple[.]networkextension[.][-0-9A-Z_a-z]+[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.securityd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd_privileged") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.CoreServices.coreservicesd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.logd.admin") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 6c0c) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-register + (global-name "com.apple.nehelper") + (global-name "com.apple.networkd_privileged") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network* + (local udp "*:500") + (local udp "*:4500") + (literal "/private/var/run/racoon.sock")) +(allow network-outbound + (remote udp "*:*") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-any (control-name "com.apple.flow-divert") +(control-name "com.apple.net.necp_control") +(control-name "com.apple.net.netagent") +(control-name "com.apple.net.utun_control") +(control-name "com.apple.network.advisory") +(control-name "com.apple.content-filter")) + (control-name "com.apple.net.ipsec_control")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.operator") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl* + (require-any (sysctl-name "kern.ipc.io_policy.throttled") +(sysctl-name "net."))) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.io_policy.throttled") +(sysctl-name "net.")) + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb.xml new file mode 100644 index 0000000..e14b98f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nehelper.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb new file mode 100644 index 0000000..4c0442b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb @@ -0,0 +1,770 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.vpn-plugin") + (subpath "/private/var/containers/Bundle/VPNPlugin")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/private/var/run/racoon.pid") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (subpath "/private/var/run/racoon") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal "/private/var/preferences/com.apple.networkextension.necp.plist") +(literal "/private/var/preferences/com.apple.networkextension.control.plist") +(literal "/private/var/preferences/com.apple.networkextension.cache.plist") +(literal "/private/var/preferences/com.apple.networkextension.plist") +(subpath "/private/var/containers/Bundle/VPNPlugin") +(subpath "/private/etc/ppp") +(subpath "/Developer/usr/libexec") +(literal "/usr/sbin/pppd")) + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/sbin") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nesessionmanager")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nesessionmanager")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.nesessionmanager") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/run/racoon") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/log/ppp.log") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nesessionmanager")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nesessionmanager")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.CoreServices.coreservicesd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.UNCUserNotification") +(global-name "com.apple.neagent") +(global-name "com.apple.symptom_analytics")) + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networking.captivenetworksupport") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ocspd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.networkextension") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-exec* + (literal "/usr/sbin/pppd")) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow sysctl* + (sysctl-name "net.key.natt_keepalive_interval")) +(allow sysctl-read + (sysctl-name "net.key.natt_keepalive_interval") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.key.blockacq_count") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb.xml new file mode 100644 index 0000000..c122ac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.nesessionmanager.sb.xml @@ -0,0 +1,48 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb new file mode 100644 index 0000000..b08659d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb @@ -0,0 +1,509 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Logs/awd/awd-networkserviceproxy.log") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-networkserviceproxy.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "networkserviceproxy") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "networkserviceproxy")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow sysctl*) +(allow sysctl-write) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb.xml new file mode 100644 index 0000000..951b1a3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.networkserviceproxy.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb new file mode 100644 index 0000000..3933b52 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb @@ -0,0 +1,836 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.quicklook.readonly") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Media/Books") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look") +(subpath-prefix "${HOME}/Library/Caches/com.apple.QuickLook.thumbnailcache")) + (extension "com.apple.quicklook.readonly") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Documents" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look") +(subpath-prefix "${HOME}/Library/Caches/com.apple.QuickLook.thumbnailcache")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "AGXSharedUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.revisiond") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.FileProvider") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.bird.token") + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.distributed_notifications@1v3") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.quicklook.ThumbnailsAgent") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.quicklook.ThumbnailsAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb new file mode 100644 index 0000000..09d26c8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb @@ -0,0 +1,658 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal "/usr/libexec/rtcreportingd") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/rtcreportingd_")) + (extension "com.apple.rtcreporting.upload") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/rtcreportingd_")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (extension "com.apple.rtcreporting.upload")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlogd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "rtcreportingd") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.timed") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.VideoConference") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.rtcreporting") + (preference-domain "rtcreportingd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.rtcreportingd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb new file mode 100644 index 0000000..bd0c2f2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb @@ -0,0 +1,67 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/dtracehelper")) +(allow file-link) +(allow file-map-executable) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.sandbox.system-group") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Sandbox-.+[.]ips") + (regex #"^/private/var/logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/logs/CrashReporter/[.]Sandbox-.+[.]ips") + (require-all + (require-not (file-mode #o0000)) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (34 a381 a080 6878) + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.containermanagerd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger")) +(allow mach-task-name) +(allow network-outbound + (literal "/private/var/run/asl_input")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb.xml new file mode 100644 index 0000000..4f2f666 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.sandboxd.sb.xml @@ -0,0 +1,47 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb new file mode 100644 index 0000000..a11eadb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb @@ -0,0 +1,583 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.webinspector") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.siri.ClientFlow.ClientScripter") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.assistant") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.siri.ClientFlow.ClientScripter")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb new file mode 100644 index 0000000..98acf00 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb @@ -0,0 +1,212 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/var/mobile/Library/Caches") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-register + (global-name "com.apple.snhelper") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.snhelper.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb new file mode 100644 index 0000000..a6f7256 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb @@ -0,0 +1,604 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.tcc.") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/tmp/com.apple.tccd") +(subpath-prefix "${HOME}/Library/TCC")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]tccd/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.services") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (global-name "com.apple.backboard.systemservices") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb.xml new file mode 100644 index 0000000..eabff4c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tccd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb new file mode 100644 index 0000000..19bd1d2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb @@ -0,0 +1,27 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow file-write-create + (literal "/private/var/db/timezone/localtime")) +(allow file-write-unlink + (literal "/private/var/db/timezone/localtime")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.tzlinkd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb new file mode 100644 index 0000000..0235986 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb @@ -0,0 +1,356 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/sbin") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal "/usr") +(literal "/usr/sbin/wirelessproxd")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.touchsetupd.wirelessproximity") + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.wirelessproxd.debug") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.wirelessproxd.debug")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/com.apple.wirelessproxd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb new file mode 100644 index 0000000..3d1bfe2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb @@ -0,0 +1,456 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/AddressBook") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.contactsd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-entitlement "com.apple.coreduetd.allow" + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences"))) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.contactsd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AGXDevice")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/contactsd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb new file mode 100644 index 0000000..332e8b5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb @@ -0,0 +1,3638 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-entitlement "com.apple.private.librarian.container-proxy") + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.usernotifications.attachments.read-only")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Calendar") + (entitlement-value "com.apple.mobilecal")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/ReplayKit") + (entitlement-value "com.apple.ReplayKit.RPVideoEditorExtension")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (extension-class "com.apple.mediaserverd.read") + (entitlement-value "com.apple.mobilemail")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (entitlement-value "com.apple.Music") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (entitlement-value "com.apple.mobilemail") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (debug-mode) + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Caches/com.apple.navd/NavTraces") + (entitlement-value "com.apple.Maps")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (entitlement-value "com.apple.Music") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (entitlement-value "com.apple.Music") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sharing.airdrop.readonly") + (entitlement-value "com.apple.UIKit.ShareUI")) + (require-all + (subpath-prefix "${HOME}/Library/CallServices/Ringtones") + (extension-class "com.apple.mediaserverd.read") + (entitlement-value "com.apple.InCallService")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (entitlement-value "com.apple.mobilemail") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))))))) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/usr/lib") + (extension "com.apple.app-sandbox.read") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal "/AppleInternal/Library/Frameworks/CoreAutomation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iStreamer")))) +(allow file-read* + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (require-not (literal "/private/var/mobile/Media/iTunes_Control/iTunes/iTunesPrefs")) + (require-any + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Developer") + (require-entitlement "com.apple.media.ringtones.read-write") + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (subpath-prefix "${HOME}/Library/BulletinDistributor/Attachments") + (extension "com.apple.bulletindistributor.attachments.read-only")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.apsalerts.plist")) + (require-any + (require-all + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (subpath "/private/var/tmp/com.apple.dt.XCTest") + (require-any + (process-name "/Applications/") + (require-entitlement "get-task-allow"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (regex #"^/private/var/mobile/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/euser[0-9]+/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/[-0-9A-F]+/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/Users/[^/]+/Library/GameKit/Data/[^/]+.gcdata$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/")))) + (require-all + (extension "com.apple.fileprovider.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Fonts") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.tcc.kTCCServiceMediaLibrary")))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/SpringBoard/OriginalHomeVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/OriginalLockVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/LockBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/LockBackgroundThumbnail.jpg") +(literal-prefix "${HOME}/Library/SpringBoard/LockVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/.LockBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/.HomeBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/HomeVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/HomeBackgroundThumbnail.jpg") +(literal-prefix "${HOME}/Library/SpringBoard/HomeBackground.cpbitmap")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension "com.apple.usernotifications.attachments.read-only")) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (entitlement-value "com.apple.mobilemail")) + (require-all + (extension "com.apple.sharing.airdrop.readonly") + (entitlement-value "com.apple.UIKit.ShareUI")) + (require-all + (subpath-prefix "${HOME}/Media/Safari") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (entitlement-value "com.apple.Maps")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$") + (entitlement-value "com.apple.PassbookUIService")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (require-any + (require-any (entitlement-value "com.apple.Music") +(entitlement-value "com.apple.PassbookUIService") +(entitlement-value "com.apple.stocks.watchkitextension")) + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.restrictionspassword.plist") + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync") + (entitlement-value "com.apple.Music")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$") + (entitlement-value "com.apple.stocks.watchkitextension")))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd"))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (entitlement-value "com.apple.Maps")) + (require-all + (subpath-prefix "${HOME}/Media") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (subpath "/Library/Application Support/Mail/Plugins") +(literal "/private/var/preferences/SystemConfiguration/com.apple.AutoWake.plist") +(literal "/System/Library/PairedSyncServices/com.apple.pairedsync.mail.plist")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal "/AppleInternal/Library/Frameworks/CoreAutomation") + (entitlement-value "com.apple.iStreamer")) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (entitlement-value "com.apple.mobilemail")) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (entitlement-value "com.apple.Maps")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mobilemail") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mobilemail")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (entitlement-value "com.apple.Music")) + (require-all + (literal "/usr/libexec") + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices")) + (entitlement-value "com.apple.ios.StoreKitUIService")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.parsecd/CustomFeedback/SafariAutoFill") +(subpath-prefix "${HOME}/Library/Caches/com.apple.parsecd/CustomFeedback/SafariAutoPlay")) + (entitlement-value "com.apple.mobilesafari")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp"))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (subpath-prefix "${HOME}/Library/CallServices/Ringtones") + (entitlement-value "com.apple.InCallService")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") +(literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock")) + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$") + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService"))))))) + (require-all + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (require-any + (require-entitlement "com.apple.security.exception.carrier-bundle.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID")))))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/GameKit/Data") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type SYMLINK) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/printd") + (extension "com.apple.app-sandbox.read") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-entitlement "com.apple.system.set-alert-tone") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (entitlement-value "com.apple.Music") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (entitlement-value "com.apple.ios.StoreKitUIService")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (entitlement-value "com.apple.Music")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (entitlement-value "com.apple.Music")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (entitlement-value "com.apple.ios.StoreKitUIService")) + (require-all + (vnode-type DIRECTORY) + (entitlement-value "com.apple.mobilemail") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID")))))) +(allow file-test-existence + (3b 0000 a080 6288) + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-all (require-not (literal-prefix "${HOME}/Library/Application Support/CloudDocs/session/containers/")) +(require-not (literal-prefix "${HOME}/Library/Caches/BridgeIconCache/")) +(require-not (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.CloudDocsUI.CloudSharing/")) +(require-not (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird/")) +(require-not (literal-prefix "${HOME}/Library/CallServices/Ringtones/")) +(require-not (literal-prefix "${HOME}/Library/SpringBoard/PushStore/")) +(require-not (literal-prefix "${HOME}/Library/SpringBoard/ApplicationShortcuts/")) +(require-not (literal-prefix "${HOME}/Library/SMS/")) +(require-not (literal-prefix "${HOME}/Library/OnDemandResources/Manifests/")) +(require-not (literal-prefix "${HOME}/Library/Mobile Documents/")) +(require-not (literal-prefix "${HOME}/Library/Mobile Documents/Media/Recordings/")) +(require-not (literal-prefix "${HOME}/Library/")) +(require-not (literal "/private/var/Managed Preferences/mobile/"))) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-write* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.revisiond.staging") + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (extension "com.apple.fileprovider.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type SYMLINK) + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (entitlement-value "com.apple.Music")) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp"))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mobilemail") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mobilemail")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (entitlement-value "com.apple.mobilesafari") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.parsecd/CustomFeedback/SafariAutoFill") +(subpath-prefix "${HOME}/Library/Caches/com.apple.parsecd/CustomFeedback/SafariAutoPlay"))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (require-all + (entitlement-value "com.apple.Music") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMusicSync")) + (require-all + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI") + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.restrictionspassword.plist")) + (require-all + (entitlement-value "com.apple.Maps") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/")) + (require-all + (entitlement-value "com.apple.mobilemail") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail")))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") +(literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock")) + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd"))) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (entitlement-value "com.apple.Maps")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (entitlement-value "com.apple.mobilemail")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/SystemData/com.apple.SafariViewService$") + (subpath-prefix "${FRONT_USER_HOME}") + (entitlement-value "com.apple.SafariViewService")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper"))) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (entitlement-value "com.apple.mobilemail")) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (entitlement-value "com.apple.Maps")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail") + (require-any + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd")))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (entitlement-value "com.apple.Music")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (entitlement-value "com.apple.ios.StoreKitUIService"))))))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (entitlement-value "com.apple.Music")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (entitlement-value "com.apple.mobilemail")) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (entitlement-value "com.apple.ios.StoreKitUIService"))))))) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents")))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail") + (require-any + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd"))))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-entitlement "com.apple.container2") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")) + (require-any + (subpath-prefix "${HOME}/Media/Podcasts") + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary")))))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow generic-issue-extension + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari") + (require-any (extension-class "com.apple.webkit.camera") +(extension-class "com.apple.webkit.microphone") +(extension-class "com.apple.webkit.webrtc"))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (require-all + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (require-entitlement "com.apple.private.amfi.can-load-cdhash")) + (require-all + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (iokit-user-client-class "RootDomainUserClient") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (iokit-user-client-class "IOMobileFramebufferUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow iokit-get-properties + (iokit-property "IOClass") + (require-any (iokit-property "IOClassNameOverride") +(iokit-property "IOCFPlugInTypes") +(iokit-property "IORegistryEntryPropertyKeys")) + (require-entitlement "com.apple.system.diagnostics.iokit-properties") + (require-all + (iokit-property-regex #"-mac-address" #"mac-address-" #".+-mac-address" #".+mac-address-") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access"))) + (require-all + (require-any (iokit-property "IOProviderClass") +(iokit-property "IOFeatures")) + (iokit-user-client-class "IONetworkController")) + (require-all + (iokit-property "boot-manifest-hash") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "soc-generation") + (process-attribute 4) + (iokit-user-client-class "IOPlatformDevice") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-property "IOMACAddress") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access"))) + (require-all + (require-any (iokit-property "IOAccessoryBatteryPack") +(iokit-property "IOAccessoryDigitalID") +(iokit-property "IOAccessoryInterfaceDeviceInfo") +(iokit-property "IOAccessoryID") +(iokit-property "IOAccessoryManagerType") +(iokit-property "IODeviceMemory") +(iokit-property "config-number") +(iokit-property "controllers") +(iokit-property "AppleDiagnostic") +(iokit-property "CrashReporter-ID") +(iokit-property "Device Characteristics")) + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "model") +(iokit-property "platform-name") +(iokit-property "regulatory-model-number") +(iokit-property "region-info")) + (iokit-user-client-class "IOPlatformExpertDevice")) + (require-all + (iokit-property "client") + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient")) + (require-all + (iokit-property-regex #"serial-number" #"SerialNum" #"-snum" #".+serial-number" #".+SerialNum" #".+-snum") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "AGXParameterBufferMaxSize") +(iokit-property "InternalStatistics") +(iokit-property "InternalStatisticsAccm") +(iokit-property "PerformanceStatisticsAccum") +(iokit-property "MetalStatisticsName")) + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (iokit-property "IOClass") + (iokit-user-client-class "IONetworkController")) + (require-all + (require-any (iokit-property "CFBundleIdentifier") +(iokit-property "IOLinkSpeed") +(iokit-property "IOLinkStatus") +(iokit-property "IOPropertyMatch") +(iokit-property "IOMinPacketSize") +(iokit-property "IOMaxPacketSize")) + (iokit-user-client-class "IONetworkController")) + (require-all + (require-any (iokit-property "idProduct") +(iokit-property "idVendor") +(iokit-property "Product Name") +(iokit-property "kUSBProductString")) + (iokit-connection "AppleSynopsysOTGDevice")) + (require-all + (iokit-property-regex #"UUID" #"-uuid" #".+UUID" #".+-uuid") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "ForceSupported") +(iokit-property "SupportTapToWake")) + (require-any (iokit-user-client-class "AppleMultitouchSPI") +(iokit-user-client-class "AppleMultitouchDevice"))) + (require-all + (require-any (iokit-property "interval") +(iokit-property "mode") +(iokit-property "useMag") +(iokit-property "QueueSize")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient")) + (require-all + (iokit-connection "AppleSynopsysOTGDevice") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "udid-version") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "root-ticket-hash") +(iokit-property "backlight-marketing-table") +(iokit-property "device-imei") +(iokit-property "IOCPUID")) + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "gyro-interrupt-calibration") + (require-any (iokit-user-client-class "AppleOscarNub") +(iokit-user-client-class "AppleSPUHIDInterface"))) + (require-all + (iokit-property-regex #"[Cc]alibration" #".+[Cc]alibration") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "Size") + (iokit-user-client-class "IOMedia")) + (require-all + (iokit-property "PerformanceStatistics") + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (iokit-property "AppleJPEG") + (iokit-user-client-class "AppleJPEGDriver")) + (require-all + (iokit-user-client-class "IOService") + (require-any + (require-any (iokit-property "software-behavior") +(iokit-property "3d-maps") +(iokit-property "3d-imagery") +(iokit-property "no-sdio-devices") +(iokit-property "navigation") +(iokit-property "display-scale") +(iokit-property "display-rotation") +(iokit-property "decoding") +(iokit-property "chip-id") +(iokit-property "video-stills") +(iokit-property "video-cap") +(iokit-property "rear-slowmo") +(iokit-property "rear-max-video-") +(iokit-property "rear-max-slomo-video-fps-") +(iokit-property "rear-hdr") +(iokit-property "rear-hdr-on") +(iokit-property "rear-burst") +(iokit-property "rear-burst-image-duration") +(iokit-property "rear-auto-hdr") +(iokit-property "post-effects") +(iokit-property "pipelined-stillimage-capability") +(iokit-property "pearl-camera") +(iokit-property "panorama") +(iokit-property "live-photo-capture") +(iokit-property "live-effects") +(iokit-property "front-max-video-") +(iokit-property "front-hdr") +(iokit-property "front-hdr-on") +(iokit-property "front-flash-capability") +(iokit-property "front-burst") +(iokit-property "front-burst-image-duration") +(iokit-property "front-auto-hdr") +(iokit-property "flash") +(iokit-property "auto-focus") +(iokit-property "aggregate-cam-video-zoom") +(iokit-property "adaptive-ui") +(iokit-property "tnr-mode") +(iokit-property "encoding") +(iokit-property "bitrate-")) + (require-any (iokit-property "name") +(iokit-property "device_type") +(iokit-property "device-type") +(iokit-property "Protocol Characteristics") +(iokit-property "IOSurfaceAcceleratorCapabilitiesDict")) + (require-all + (require-any (iokit-property "unique-chip-id") +(iokit-property "uid-aes-key") +(iokit-property "AAPL,phandle") +(iokit-property "#address-cells") +(iokit-property "system-trusted") +(iokit-property "software-bundle-version") +(iokit-property "security-domain") +(iokit-property "secure-boot") +(iokit-property "root-matching") +(iokit-property "random-seed") +(iokit-property "production-cert") +(iokit-property "mix-n-match-prevention-status") +(iokit-property "mac-address-wifi0") +(iokit-property "mac-address-ethernet0") +(iokit-property "mac-address-bluetooth0") +(iokit-property "image4-supported") +(iokit-property "gid-aes-key") +(iokit-property "firmware-version") +(iokit-property "effective-security-mode-sep") +(iokit-property "effective-security-mode-ap") +(iokit-property "effective-production-status-sep") +(iokit-property "effective-production-status-ap") +(iokit-property "dram-vendor") +(iokit-property "dram-vendor-id") +(iokit-property "die-id") +(iokit-property "development-cert") +(iokit-property "debug-enabled") +(iokit-property "crypto-hash-method") +(iokit-property "consistent-debug-root") +(iokit-property "chip-epoch") +(iokit-property "certificate-security-mode") +(iokit-property "certificate-production-status") +(iokit-property "bootp-response") +(iokit-property "boot-nonce") +(iokit-property "board-id")) + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "boot-manifest-hash") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))))) + (require-all + (iokit-property "PerformanceStatistics") + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (iokit-property-regex #"die-id$" #"chip-id$" #"board-id$" #".+((die|chip)|board)-id$") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "iommu-present") + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "BaseAddressAlignmentRequirement") +(iokit-property "IOGLES") +(iokit-property "MetalPluginClassName") +(iokit-property "MetalPluginName")) + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (require-any (iokit-property "AppleTV") +(iokit-property "DisplayPipePlaneBaseAlignment") +(iokit-property "DisplayPipeStrideRequirements") +(iokit-property "hdcp-hoover-protocol") +(iokit-property "appleTV-VID1") +(iokit-property "appleTV-VID0")) + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (iokit-property "emu") + (iokit-user-client-class "IODTNVRAM")) + (require-all + (require-any (iokit-property "als-colorCfg") +(iokit-property "noMultiColorSupport")) + (iokit-user-client-class "AppleARMIICDevice")) + (require-all + (require-any (iokit-property "battery-data") +(iokit-property "BatteryData") +(iokit-property "Serial")) + (iokit-connection "IOPMPowerSource") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (iokit-property "home-button-type") + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "camera-front") +(iokit-property "camera-rear")) + (iokit-user-client-class "AppleARMIODevice")) + (require-all + (iokit-property "SupportAlwaysOnCompass") + (iokit-user-client-class "AppleSPUHIDDriver")) + (require-all + (require-any (iokit-property "BSD Name") +(iokit-property "InterfaceRole") +(iokit-property "IORequiredPacketFilters") +(iokit-property "IO80211Band") +(iokit-property "IO80211Channel") +(iokit-property "IO80211ChannelFrequency") +(iokit-property "IO80211ChannelBandwidth") +(iokit-property "IO80211RSNDone") +(iokit-property "IOPrimaryInterface") +(iokit-property "IONetworkRootType") +(iokit-property "IONetworkData") +(iokit-property "IOMediaHeaderLength") +(iokit-property "IOMediaAddressLength") +(iokit-property "IOMaxTransferUnit") +(iokit-property "IOLocation") +(iokit-property "IOInterfaceUnit") +(iokit-property "IOInterfaceType") +(iokit-property "IOInterfaceState") +(iokit-property "IOInterfaceNamePrefix") +(iokit-property "IOInterfaceFlags") +(iokit-property "IOInterfaceExtraFlags") +(iokit-property "IOControllerEnabled") +(iokit-property "IOBuiltin") +(iokit-property "IOActivePacketFilters") +(iokit-property "NetworkConfigurationOverrides")) + (iokit-user-client-class "IONetworkInterface")) + (require-all + (require-any (iokit-property "AdapterInfo") +(iokit-property "AtCriticalLevel") +(iokit-property "Voltage") +(iokit-property "MaxCapacity") +(iokit-property "IsCharging") +(iokit-property "FullyCharged") +(iokit-property "ExternalConnected") +(iokit-property "ExternalChargeCapable") +(iokit-property "CurrentCapacity") +(iokit-property "CapacityEstimated") +(iokit-property "BatteryInstalled")) + (iokit-connection "IOPMPowerSource")) + (require-all + (iokit-property "HEVCSupported") + (iokit-user-client-class "AppleD5500")) + (require-all + (require-any (iokit-property "artwork-device-idiom") +(iokit-property "artwork-device-subtype") +(iokit-property "artwork-dynamic-displaymode") +(iokit-property "artwork-display-gamut") +(iokit-property "artwork-scale-factor") +(iokit-property "watch-companion") +(iokit-property "thin-bezel") +(iokit-property "product-id") +(iokit-property "product-description") +(iokit-property "offline-dictation") +(iokit-property "location-reminders") +(iokit-property "large-format-phone") +(iokit-property "gps-capable") +(iokit-property "graphics-featureset-fallbacks") +(iokit-property "graphics-featureset-class") +(iokit-property "dictation") +(iokit-property "device-colors") +(iokit-property "device-perf-memory-class") +(iokit-property "car-integration") +(iokit-property "compatible-device-fallback")) + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "IOProviderClass") +(iokit-property "IOFeatures")) + (iokit-user-client-class "IONetworkInterface"))) +(allow ipc-posix-sem* + (semaphore-owner self) + (require-all + (extension "com.apple.sandbox.application-group") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (require-all + (extension "com.apple.sandbox.application-group") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-create + (ipc-posix-name-regex #"^/mono[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-unlink + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (b4 0017 a080 5fbf) + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (global-name "com.apple.gamecenter") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.calaccessd") + (global-name "com.apple.healthd.server") + (global-name "com.apple.springboard.backgroundappservices") + (34 aae0 a080 5fde) + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.cloudd") + (global-name "com.apple.itdbprep.server") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.marco") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.wcd") + (require-any (global-name "com.apple.AdSheetPhone.server") +(global-name "com.apple.AdSheetPad.server") +(global-name "com.apple.MediaControl.daemon") +(global-name "com.apple.MobileAccessoryUpdater") +(global-name "com.apple.MobileFileIntegrity") +(global-name "com.apple.Music.MPMusicPlayerMigServer") +(global-name "com.apple.ReportCrash") +(global-name "com.apple.ReportCrash.DirectoryService") +(global-name "com.apple.ReportCrash.Jetsam") +(global-name "com.apple.ReportCrash.SafetyNet") +(global-name "com.apple.ReportCrash.StackShot") +(global-name "com.apple.VoiceOverTouch.xpc") +(global-name "com.apple.airplay.sender.xpc") +(global-name "com.apple.appleprofilepolicyd") +(global-name "com.apple.assetsd.keepDaemonAlive") +(global-name "com.apple.assetsd.notificationServer") +(global-name "com.apple.audio.AudioConverterServer") +(global-name "com.apple.audio.AudioFileServer") +(global-name "com.apple.audio.AudioUnitServer") +(global-name "com.apple.backboard.checkin") +(global-name "com.apple.backboard.watchdog") +(global-name "com.apple.backboard.workspaceserverconnection") +(global-name "com.apple.bypassBasebandAutoBooter.msgport") +(global-name "com.apple.callkit.callsourcehost") +(global-name "com.apple.clouddbd") +(global-name "com.apple.commcenter.dm-helper") +(global-name "com.apple.commcenter.mobile-helper") +(global-name "com.apple.coremedia.audioprocessingtap") +(global-name "com.apple.coremedia.cpe") +(global-name "com.apple.coremedia.cpe.xpc") +(global-name "com.apple.coremedia.cpeprotector") +(global-name "com.apple.coremedia.cpeprotector.xpc") +(global-name "com.apple.coremedia.formatreader") +(global-name "com.apple.coremedia.wirelessdisplay") +(global-name "com.apple.coremedia.wirelessdisplayserver") +(global-name "com.apple.cvmsCompAgent_armv7") +(global-name "com.apple.datamigrator.dz") +(global-name "com.apple.devicecheckd") +(global-name "com.apple.distributed_notifications@0v3") +(global-name "com.apple.dt.xctestd.target") +(global-name "com.apple.fileprovider.pushkit") +(global-name "com.apple.gamed.note") +(global-name "com.apple.iTunesStore.daemon.notifications.public") +(global-name "com.apple.iTunesStore.daemon.public") +(global-name "com.apple.iapauthd") +(global-name "com.apple.iapauthd.xpc") +(global-name "com.apple.imavagent.embedded.auth") +(global-name "com.apple.instruments.server.mig") +(global-name "com.apple.mDNSResponder") +(global-name "com.apple.managedconfiguration.mdmdpush-dev") +(global-name "com.apple.managedconfiguration.mdmdpush-prod") +(global-name "com.apple.managedconfiguration.mdmdservice") +(global-name "com.apple.mediastream.sharing-nowake") +(global-name "com.apple.midiserver") +(global-name "com.apple.mobile.softwareupdated") +(global-name "com.apple.mobileipod.MPMusicPlayerControllerInternal") +(global-name "com.apple.mobileipod.MPMusicPlayerMigServer") +(global-name "com.apple.mobileipod.MPMusicPlayerMigServerExists") +(global-name "com.apple.prdaily") +(global-name "com.apple.sandboxd") +(global-name "com.apple.scrod") +(global-name "com.apple.spotlight.SearchAgent") +(global-name "com.apple.springboard.UIKit.migserver") +(global-name "com.apple.springboard.alerts") +(global-name "com.apple.springboard.remotenotifications") +(global-name "com.apple.springboard.watchdogserver") +(global-name "com.apple.telephonyutilities.callservicesdaemon.voip") +(global-name "com.apple.telephonyutilities.remotelogdaemon") +(global-name "com.apple.videoconference.avconference") +(global-name "com.apple.vsassetd") +(global-name "com.apple.wapi.client") +(global-name "com.apple.watchconnectivity.complication") +(global-name "com.apple.weibod.server")) + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.midiserver.io") + (require-any (global-name "com.apple.WebBookmarks.webbookmarksd") +(global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd")) + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.Music.MPMusicPlayerControllerInternal") +(global-name "com.apple.Music.MPMusicPlayerMigServerExists")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.locationd.synchronous") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.parsecd") + (global-name "com.apple.FileCoordination") + (global-name "PurplePPTServer") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.mobile.installd") + (34 aaa8 a080 5fc9) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.testmanagerd") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.networkd") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.assetsd.changehub") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.sharingd") + (global-name "com.apple.revisiond") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.twitterd") + (global-name "com.apple.webinspector") + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (require-any (global-name "com.apple.dataaccess.dataaccessd.active") +(global-name "com.apple.passd.in-app-payment")) + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.bird.token") + (global-name "com.apple.syncdefaultsd") + (34 ab2e a080 5fd4) + (global-name "com.apple.passd.assertions") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.dataaccess.dataaccessd") + (34 aad7 a080 5fdc) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.certui.relay") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.gamed") + (require-any (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (require-any (global-name "com.apple.iap2d") +(global-name "com.apple.iaptransportd")) + (global-name "com.apple.cache_delete.public") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.contactsd") + (global-name "com.apple.bird") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.coremedia.endpoint.xpc") + (34 ce53 a080 5fca) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.atc") + (global-name "com.apple.PowerManagement.control") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.passd.library") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ait.client") + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (b4 0018 a080 5fba) + (global-name "com.apple.coremedia.videoqueue") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.iap2d.distributednotification.server") +(global-name "com.apple.iapd.distributednotification.server") +(global-name "com.apple.iaptransportd.xpc")) + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.iapd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.librariand") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.gizmoappd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.fairplayd") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.VoiceOverTouch") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.twitterd.server") + (global-name "com.apple.voiceservices.tts") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.accessibility.AXBackBoardServer") + (require-any (global-name "com.apple.accountsd.accessmanager") +(global-name "com.apple.accountsd.authmanager") +(global-name "com.apple.healthd.restriction")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.FileProvider") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.coremedia.sandboxserver") + (34 aadc a080 5fc4) + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.replayd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.assertiond.processinfoservice") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.accessories.transport-server") +(global-name "com.apple.iap2d.xpc") +(global-name "com.apple.iapd.xpc")) + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.springboard") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-all + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-not (34 a381 60f0 a081)) + (require-any + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.diagnosticd") + (34 a381 a080 60f3) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.personad.xpc") + (require-any + (require-entitlement "com.apple.private.persona.write") + (require-entitlement "com.apple.private.persona.read") + (require-entitlement "com.apple.private.contactsui"))) + (require-all + (global-name "com.apple.icfcallserver") + (require-entitlement "com.apple.private.icfcallserver")) + (require-all + (global-name "com.apple.VideoSubscriberAccount.videosubscriptionsd") + (require-any + (require-entitlement "com.apple.smoot.subscriptionservice") + (require-entitlement "com.apple.private.subscriptionservice.web-sources.read-write") + (require-entitlement "com.apple.private.subscriptionservice.internal") + (require-entitlement "com.apple.developer.video-subscription-registration") + (require-entitlement "com.apple.private.subscriptionservice.all-sources.read-only"))) + (require-all + (global-name "com.apple.cache_delete") + (require-any + (require-entitlement "com.apple.private.CacheDelete") + (require-entitlement "com.apple.mobile.deleted.AllowFreeSpace"))) + (require-all + (global-name "com.apple.icloud.findmydeviced") + (require-any + (require-entitlement "com.apple.icloud.findmydeviced.access") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.SystemConfiguration.PPPController-priv") + (require-entitlement "com.apple.networking.vpn.configuration")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.spotlight.IndexAgent") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.unfreed") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.suggestd.mail") + (require-entitlement "com.apple.private.suggestions.mail")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.siri.vocabularyupdates") + (require-any + (require-entitlement "com.apple.developer.siri") + (require-entitlement "com.apple.siri.synapse"))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.aps.alertprovider.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.managedconfiguration.profiled") + (require-entitlement "com.apple.managedconfiguration.profiled-access")) + (require-all + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.bulletinboard.observerconnection") + (require-entitlement "com.apple.bulletinboard.observer")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.utilitiesconnection") + (require-entitlement "com.apple.bulletinboard.utilities")) + (require-all + (global-name "com.apple.familycircle.agent") + (require-entitlement "com.apple.private.familycircle")) + (require-all + (global-name "com.apple.locationd.spi") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobilestoredemod") + (require-entitlement "com.apple.private.mobilestoredemo.enabledemo")) + (require-all + (global-name "com.apple.suggestd.spotlight") + (require-entitlement "com.apple.private.suggestions.spotlight")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (local-name "com.apple.iphone.axserver") + (require-entitlement "com.apple.accessibility.api")) + (require-all + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.suggestd.events") + (require-entitlement "com.apple.private.suggestions.events")) + (require-all + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.lskdd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.AOSNotification") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access")) + (require-all + (global-name "com.apple.suggestd.contacts") + (require-entitlement "com.apple.private.suggestions.contacts")) + (require-all + (34 ce9a 604e 6054) + (require-any + (require-entitlement "com.apple.private.imcore.spi.database-access") + (require-entitlement "com.apple.private.imcore.imdpersistence.data-detection-access ") + (require-entitlement "com.apple.private.imcore.imdpersistence.database-access"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.bulletinboard.systemstateconnection") + (require-entitlement "com.apple.bulletinboard.systemstate")) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (require-any + (require-entitlement "com.apple.private.imcore.imremoteurlconnection") + (require-entitlement "com.apple.private.ids.remoteurlconnection"))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.ABDatabaseDoctor") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.bulletinboard.settings")) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (global-name "com.apple.nanoprefsync") + (entitlement-value "com.apple.stocks.watchkitextension")) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI")) + (require-all + (global-name "com.apple.FileCoordination") + (entitlement-value "com.apple.stocks.watchkitextension")) + (require-all + (global-name "com.apple.nanoprefsync") + (entitlement-value "com.apple.Music")) + (require-all + (global-name "com.apple.routined.registration") + (entitlement-value "com.apple.Maps")) + (require-all + (global-name "com.apple.FileCoordination") + (entitlement-value "com.apple.Music")) + (require-all + (require-any (global-name "com.apple.nanomaps.xpc.Navigation") +(global-name "com.apple.nanomaps.xpc.Maps")) + (entitlement-value "com.apple.Maps")) + (require-all + (global-name "com.apple.mobilesafari-settings") + (entitlement-value "com.apple.WebSheet")) + (require-all + (global-name "com.apple.nanoprefsync") + (entitlement-value "com.apple.PassbookUIService")) + (require-all + (global-name "com.apple.Maps.SpringBoard") + (entitlement-value "com.apple.Maps")) + (require-all + (global-name "com.apple.rtcreportingd") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (global-name "com.apple.safarifetcherd") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (global-name "com.apple.assistant.analytics") + (entitlement-value "com.apple.Maps")) + (require-all + (entitlement-value "com.apple.mobilemail") + (require-any + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.mobilemail") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.backupd") + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.bulletindistributord.server") +(global-name "com.apple.harvestd.manager")) + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.routined.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.coremedia.admin") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")))) + (require-all + (global-name "com.apple.Maps.mapspushd") + (entitlement-value "com.apple.Maps")) + (require-all + (global-name "com.apple.lsd.xpc") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (global-name "com.apple.FileCoordination") + (entitlement-value "com.apple.PassbookUIService")) + (require-all + (global-name "com.apple.nanomaps.xpc.GeoServices.Navigation") + (entitlement-value "com.apple.Maps")))))) +(allow mach-register + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (require-not (global-name-regex #"-idswake$" #".+-idswake$")) + (require-any + (local-name "com.apple.iphone.axserver") + (local-name "com.apple.accessibility.gax.client") + (local-name "com.apple.assistant.contextprovider.") + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music") + (require-any (global-name "com.apple.Music.MPMusicPlayerControllerInternal") +(global-name "com.apple.Music.MPMusicPlayerMigServerExists")))))) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-register.global-name"))) +(allow network-inbound + (local ip "*:*") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$"))) +(allow network-outbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (remote tcp "localhost:22")) + (require-not (remote tcp "localhost:23")) + (require-not (remote tcp "localhost:873")) + (require-not (remote tcp "localhost:62078")) + (require-any + (remote ip "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/printd") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (literal "/private/var/run/lockdown.sock") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mobilecal.alarmengine") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.itdbprep.server") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (require-any (preference-domain "com.apple.MobileAddressBook") +(preference-domain "com.apple.VoiceMemos") +(preference-domain "com.apple.XCTest") +(preference-domain "com.apple.certui") +(preference-domain "com.apple.gamekit") +(preference-domain "com.apple.imagent") +(preference-domain "com.apple.madrid") +(preference-domain "com.apple.managedconfiguration.janitor") +(preference-domain "com.apple.messagesbadgecontroller") +(preference-domain "com.apple.mobile.SyncMigrator") +(preference-domain "com.apple.mobileme.fmf.assistant") +(preference-domain "com.apple.mobilestoresettings") +(preference-domain "com.apple.mobiletimer") +(preference-domain "com.apple.mobilevpn") +(preference-domain "com.apple.network.eapclient.tls.TrustExceptions") +(preference-domain "com.apple.nike") +(preference-domain "com.apple.preferences.datetime") +(preference-domain "com.apple.preferences.network") +(preference-domain "com.apple.softwareupdateservicesd") +(preference-domain "com.apple.voicemail") +(preference-domain "itdbprepserver") +(preference-domain "mediaremote")) + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilenotes") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.da") + (preference-domain "com.apple.hangtracer") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.OTASyncState") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.atc") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.apsd") + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.ConfigServer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (require-any (preference-domain "com.apple.LaunchServices") +(preference-domain "com.apple.avfoundation.videoperformancehud")) + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.dataaccess.dataaccessd") + (require-all + (require-any (preference-domain "com.apple.MailAccount-ExtProperties") +(preference-domain "com.apple.OTASyncAgent")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.coreaudio") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.avfoundation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.homesharing") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (preference-domain "com.apple.coremedia") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.coremedia"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (preference-domain "com.apple.NanoMailKit") +(preference-domain "com.apple.internal.Voltaire") +(preference-domain "com.skyhookwireless.wps")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.medialibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.security"))) + (require-all + (preference-domain "com.apple.books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.corevideo") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper"))) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only") + (require-all + (preference-domain "com.apple.ist.AppleConnect") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ist.AppleConnect.extension")))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu")))) + (require-entitlement "com.apple.container2"))) + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (require-all + (entitlement-value "com.apple.mobilemail") + (require-any + (preference-domain "com.apple.cloud.quota") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.OTASyncState") + (require-any (preference-domain "com.apple.MailAccount-ExtProperties") +(preference-domain "com.apple.OTASyncAgent")))) + (require-all + (preference-domain "com.apple.youtube.dp") + (entitlement-value "com.apple.mobilesafari")) + (require-all + (entitlement-value "com.apple.Maps") + (require-any + (preference-domain "com.apple.GMM") + (require-any (preference-domain "com.apple.NanoMailKit") +(preference-domain "com.apple.internal.Voltaire") +(preference-domain "com.skyhookwireless.wps")) + (preference-domain "com.apple.assistant"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (entitlement-value "com.apple.iCloudDriveApp")))))) +(allow process-info-codesignature + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension")) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow process-info-dirtycontrol + (target self)) +(allow process-info-rusage + (require-entitlement "com.apple.security.exception.process-info")) +(allow process-info-pidinfo + (target self) + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (target others) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd")) + (require-entitlement "com.apple.DiagnosticExtensions.extension")))) +(allow pseudo-tty) +(allow signal + (target self) + (require-all + (target others) + (require-any + (require-entitlement "com.apple.DiagnosticExtensions.extension") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))))) +(allow socket-ioctl) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-any + (require-entitlement "com.apple.DiagnosticExtensions.extension") + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (sysctl-name "kern.proc.all") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))))) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.proc.") + (require-any + (require-entitlement "com.apple.DiagnosticExtensions.extension") + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (sysctl-name "kern.proc.all") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))))) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-info + (require-all + (info-type "net.link.addr") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb.xml new file mode 100644 index 0000000..e18b609 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/container.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb new file mode 100644 index 0000000..f36ef90 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb @@ -0,0 +1,589 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.containermanagerd") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/installd/Library/Caches") +(subpath "/private/var/networkd/Containers") +(subpath "/private/var/root/Library/Logs/MobileContainerManager") +(subpath "/private/var/root/Library/MobileContainerManager") +(literal "/private/var/root/Library/MobileContainerManager.") +(literal "/private/var/") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/MobileContainerManager") +(subpath-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager") +(literal-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager.")) + (literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers" #"^/private/var/[-0-9A-F]+/Library/Backup/SystemContainers" #"^/private/var/Users/[^/]+/Library/Backup/SystemContainers") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers" #"^/private/var/[-0-9A-F]+/Containers" #"^/private/var/Users/[^/]+/Containers") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (require-any (literal "/private/var/installd/Library") +(literal "/private/var/installd/Library/Logs") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs") +(literal-prefix "${FRONT_USER_HOME}/Library")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/installd/Library/Caches") +(subpath "/private/var/networkd/Containers") +(subpath "/private/var/root/Library/Logs/MobileContainerManager") +(subpath "/private/var/root/Library/MobileContainerManager") +(literal "/private/var/root/Library/MobileContainerManager.") +(literal "/private/var/") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/MobileContainerManager") +(subpath-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager") +(literal-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager.")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.containermanagerd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers" #"^/private/var/[-0-9A-F]+/Library/Backup/SystemContainers" #"^/private/var/Users/[^/]+/Library/Backup/SystemContainers") + (literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/containers") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers" #"^/private/var/[-0-9A-F]+/Containers" #"^/private/var/Users/[^/]+/Containers") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal "/private/var/installd/Library") +(literal "/private/var/installd/Library/Logs") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs") +(literal-prefix "${FRONT_USER_HOME}/Library"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/containermanagerd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb new file mode 100644 index 0000000..026d978 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb @@ -0,0 +1,150 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/root/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/System/Library/Caches/com.apple.coresymbolicationd") +(subpath "/private/var/root/Library/Caches/com.apple.coresymbolicationd")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/root/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/coresymbolicationd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb new file mode 100644 index 0000000..12b2942 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb @@ -0,0 +1,230 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/logs/WirelessLibraryLogs") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Logs") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/logs/WirelessLibraryLogs") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/cplogd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb new file mode 100644 index 0000000..d34cec2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb @@ -0,0 +1,147 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ctkd.slot-client") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ctkd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb new file mode 100644 index 0000000..cbe68b2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb @@ -0,0 +1,796 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/AppleInternal/Library/Frameworks") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/DataAccess") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/") +(literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.activesync")) + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal-prefix "${HOME}/Library/Safari/BookmarksSyncMetadata.plist") +(literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${HOME}/Library/Mail") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/") +(literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.activesync")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Mail") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Notes") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal")) + (require-any (literal-prefix "${HOME}/Library/Safari/BookmarksSyncMetadata.plist") +(literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/DataAccess") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Safari")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "RootDomainUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.calaccessd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.persistentconnection-mcc") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.dataaccess.activesync") +(preference-domain "com.apple.dataaccess.babysitter")) + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.accountsd") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.dataaccess.dataaccessd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.dataaccess.activesync") +(preference-domain "com.apple.dataaccess.babysitter")) + (preference-domain "com.apple.mobilecal") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb.xml new file mode 100644 index 0000000..1d2d1e8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/dataaccessd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb new file mode 100644 index 0000000..0ba30c5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb @@ -0,0 +1,275 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/db/datadetectors") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/db/datadetectors") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/datadetectors.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb new file mode 100644 index 0000000..b495e8d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb @@ -0,0 +1,224 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (literal "/private/etc/hosts") + (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-priv-task-port) +(allow network-inbound + (local tcp "localhost:*") + (remote tcp "localhost:*")) +(allow network-outbound + (literal "/private/var/run/lockdown/checkin")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-debug) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb.xml new file mode 100644 index 0000000..5aa82b6 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/debugserver.sb.xml @@ -0,0 +1,48 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb new file mode 100644 index 0000000..54f2c3b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb @@ -0,0 +1,512 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (require-any (subpath "/AppleInternal/Library/CacheDelete") +(subpath-prefix "${HOME}/Library/Caches/com.apple.cache_delete") +(subpath-prefix "${HOME}/Library/Logs/CacheDelete")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/System/Library/CacheDelete") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath "/AppleInternal/Library/CacheDelete") +(subpath-prefix "${HOME}/Library/Caches/com.apple.cache_delete") +(subpath-prefix "${HOME}/Library/Logs/CacheDelete")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "cache_delete.fb_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name-regex #"^com[.]apple[.].+[Cc]ache[Dd]elete$") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.mobile.cache_delete_") +(global-name "com.apple.ind.xpc")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name-regex #"^com[.]apple[.].+cache-delete$") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (remote tcp "*:443")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.cache_delete") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.cache_delete")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-fsctl + (fsctl-command (_IO "J" 18)) + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 28)) + (fsctl-command (_IO "h" 29)) + (fsctl-command (_IO "h" 27))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/deleted.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb new file mode 100644 index 0000000..7c29093 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb @@ -0,0 +1,512 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties + (require-all + (iokit-property "public-key-accelerator") + (iokit-user-client-class "IOPlatformDevice"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.proc.pid.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb.xml new file mode 100644 index 0000000..6807187 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/devicecheckd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb new file mode 100644 index 0000000..a9dba3c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb @@ -0,0 +1,110 @@ +(version 1) +(allow default) +(deny file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))) + (require-all + (extension "com.apple.sandbox.executable") + (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(deny file-mount) +(deny file-mount-update) +(deny file-read* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-all (require-not (subpath "/System/Library/Frameworks")) +(require-not (subpath "/System/Library/PrivateFrameworks"))) + (require-not (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist")) + (require-not (subpath "/private/var/preferences/Logging")) + (require-not (subpath "/System/Library")) + (require-not (subpath "/usr/lib")) + (require-not (subpath "/usr/share")) + (require-not (subpath "/private/var/db/timezone")) + (require-not (subpath "/Developer")) + (require-not (extension "com.apple.app-sandbox.read-write")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-only")) + (require-not (extension "com.apple.app-sandbox.read")) + (require-not (extension "com.apple.sandbox.executable")) + (require-any + (require-all + (require-all (require-not (literal "/dev/zero")) +(require-not (literal "/dev/null"))) + (require-all (require-not (subpath "/private/var/db/datadetectors/sys")) +(require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library"))) + (require-all (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo"))) + (require-not (literal "/dev/dtracehelper")) + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-not (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")))))) +(deny file-read-data + (require-all + (extension "com.apple.sandbox.executable") + (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/"))) +(deny file-unmount) +(deny file-write* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.app-sandbox.read-write")) + (require-any + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(deny file-write-create + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private"))) +(deny file-write-data + (require-all + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")))) +(deny file-write-setugid) +(deny job-creation) +(deny sysctl-read + (require-all + (require-not (extension "com.apple.security.exception.sysctl.read-write")) + (require-not (extension "com.apple.security.exception.sysctl.read-only")) + (sysctl-name "sysctl.proc_native"))) +(deny system-info + (info-type "net.link.addr")) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb.xml new file mode 100644 index 0000000..2669993 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/distnoted.sb.xml @@ -0,0 +1,25 @@ + + + + + + + + + +]> + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb new file mode 100644 index 0000000..1e3b401 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb @@ -0,0 +1,640 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Library/DuetExpertCenter") +(subpath-prefix "${HOME}/Library/Logs/CallHistory") +(literal-prefix "${HOME}/Library/Logs/coreduetd.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.duetexpertd")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath "/usr/lib") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/libexec") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/proactive_" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]proactive_" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?proactive_" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?proactive_" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?proactive_") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter")) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/CoreDuet") + (require-any (subpath-prefix "${HOME}/Library/DuetExpertCenter") +(subpath-prefix "${HOME}/Library/Logs/CallHistory") +(literal-prefix "${HOME}/Library/Logs/coreduetd.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.duetexpertd")) + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]apppredictionsync") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/proactive_" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]proactive_" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?proactive_" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?proactive_" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?proactive_") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name "/sas_prediction_cache")) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.contactsd") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.atc.xpc.sessions") +(global-name "com.apple.duet.expertcenter")) + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.calaccessd") + (global-name "com.apple.routined.registration") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") +(preference-domain "com.apple.duetexpertd")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.spotlightui") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") +(preference-domain "com.apple.duetexpertd")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaremote") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/duetexpertd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb new file mode 100644 index 0000000..082061f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.network.EAPOLController") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb.xml new file mode 100644 index 0000000..9c28723 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/eapolclient.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb new file mode 100644 index 0000000..dd2ad1d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb @@ -0,0 +1,634 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.fileprovider.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.fileproviderd") +(subpath-prefix "${HOME}/Library/FileProvider")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/MobileIdentityData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+[.]appex/" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+[.]appex$" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+[.]appex/" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+[.]appex$") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$") + (subpath-prefix "${HOME}")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.fileproviderd") +(subpath-prefix "${HOME}/Library/FileProvider")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/File Provider Storage$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/com.apple.iWork$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties + (require-all + (iokit-property "soc-generation") + (iokit-user-client-class "IOPlatformDevice"))) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs."))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.apsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/"))) +(allow network-outbound + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/"))) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.fileproviderd") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.fileproviderd")) +(allow process-info-codesignature) +(allow process-info-pidinfo) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb.xml new file mode 100644 index 0000000..4d996cb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fileproviderd.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb new file mode 100644 index 0000000..93a76fd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb @@ -0,0 +1,865 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.findmydeviced")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/MDM.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/MDM.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/MDM.plist")) + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/usr/libexec/findmydeviced") + (literal "/private/var/empty") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.findmydeviced")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/euser[0-9]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/[-0-9A-F]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/Users/[^/]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "ProvInfoIOKitUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "findmydeviced.boot_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.accessories.transport-server") +(global-name "com.apple.iap2d.xpc") +(global-name "com.apple.iapd.xpc")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.marco") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (34 aadc a080 5506) + (global-name "com.apple.securityd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobileactivationd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 9a2b) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/lockdown.sock") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.demo-settings") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AOSNotification.notbackedup") +(preference-domain "com.apple.managedconfiguration.notbackedup")) + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.Security") + (preference-domain "com.apple.assistant.support") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.springboard") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.DataMigration")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/findmydeviced.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb new file mode 100644 index 0000000..5711398 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb @@ -0,0 +1,761 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/usr/libexec/fmfd") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/empty") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.fmfd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.fmfd")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.fmfd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.fmfd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.apsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.aps.alertprovider.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (34 a381 a080 9a2b) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.icloud.fmfd.notbackedup") +(preference-domain "com.apple.mobileme.fmf1")) + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.da") + (preference-domain "com.apple.icloud.fmfd") + (preference-domain "com.apple.apsalerts") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.persistentconnection") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.icloud.fmfd") + (require-any (preference-domain "com.apple.icloud.fmfd.notbackedup") +(preference-domain "com.apple.mobileme.fmf1"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/fmfd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb new file mode 100644 index 0000000..55747db --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb @@ -0,0 +1,389 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pfd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.MobileInternetSharing") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (local ip "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb.xml new file mode 100644 index 0000000..23f0acc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ftp-proxy-embedded.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb new file mode 100644 index 0000000..4bae1a7 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb @@ -0,0 +1,783 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/GameKit") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.gamed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.gamed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") +(subpath-prefix "${HOME}/Library/Logs/GameKit") +(subpath-prefix "${HOME}/Library/Caches/GameKit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") +(subpath-prefix "${HOME}/Library/GameKit")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/usr/libexec/gamed") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (literal "/usr/local/bin/gamecenterctl") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.gamed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.gamed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") +(subpath-prefix "${HOME}/Library/Logs/GameKit") +(subpath-prefix "${HOME}/Library/Caches/GameKit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") +(subpath-prefix "${HOME}/Library/GameKit")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.gamecenter") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.gamecenter.gsEvents") +(global-name "com.apple.authkit.xpc")) + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.fairplayd") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (remote ip "*:*") + (literal "/private/var/run/lockdown.sock") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.WebFoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.accountsd") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.conference") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.gamecenter")) +(allow process-exec* + (literal "/usr/libexec/gamed")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gamed.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb new file mode 100644 index 0000000..fe804ed --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb @@ -0,0 +1,500 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb.xml new file mode 100644 index 0000000..9c28723 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geocorrectiond.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb new file mode 100644 index 0000000..a5b7607 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb @@ -0,0 +1,675 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") +(subpath-prefix "${HOME}/Library/Caches/PlaceData") +(subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Maps") +(subpath-prefix "${HOME}/Library/GeoServices")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") +(subpath-prefix "${HOME}/Library/Caches/PlaceData") +(subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Maps") +(subpath-prefix "${HOME}/Library/GeoServices")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/lockdown.sock") + (remote ip "*:*")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ConfigServer") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.GMM")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/geod.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb new file mode 100644 index 0000000..c539a59 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb @@ -0,0 +1,636 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle/Application") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.healthd.server") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.misagent") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.cache_delete") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (require-any (global-name "com.apple.appconduitd.application-manager") +(global-name "com.apple.carousel.backlightxpc") +(global-name "com.apple.carousel.glanceservice") +(global-name "com.apple.carousel.tilenavigation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.mobile.installd") + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.sockpuppet.activeComplications") + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.ids") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.sockpuppet.activeComplications")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gizmoappd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb new file mode 100644 index 0000000..9f224e2 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb @@ -0,0 +1,594 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/GPUTools") +(subpath "/private/var/root/Library/Caches/com.apple.opengl")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2"))) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aae0 a080 9ee7) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.securityd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.appwatchdog") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.coresymbolicationd") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-priv-task-port) +(allow network-outbound + (local tcp "localhost:*") + (literal "/private/var/run/gputoolsdhelper.sock")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-exec* + (literal "/Developer/usr/libexec/gputoolsd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "sysctl.proc_native") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb.xml new file mode 100644 index 0000000..4ebb58f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/gputoolsd.sb.xml @@ -0,0 +1,51 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb new file mode 100644 index 0000000..4f7e52a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb @@ -0,0 +1,401 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (literal-prefix "${PROCESS_TEMP_DIR}/HealthWrap-") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${PROCESS_TEMP_DIR}/HealthWrap-") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.cloudd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.healthd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.private.healthd.server-internal") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthcloudd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb new file mode 100644 index 0000000..2ea544a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb @@ -0,0 +1,739 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") +(literal-prefix "${HOME}/Library/Logs/MobileBackup/MobileBackup-healthd.log") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches") +(subpath-prefix "${HOME}/Library/Health") +(literal-prefix "${HOME}/Library/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.healthd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.healthd")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.healthd") +(subpath "/Applications/Fitness.app") +(subpath "/Applications/Health.app")) + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-any (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.healthd") +(literal-prefix "${HOME}/Library/Logs/MobileBackup")) + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") +(literal-prefix "${HOME}/Library/Logs/MobileBackup/MobileBackup-healthd.log") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches") +(subpath-prefix "${HOME}/Library/Health") +(literal-prefix "${HOME}/Library/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.healthd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.healthd")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.healthd") +(literal-prefix "${HOME}/Library/Logs/MobileBackup")) + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.apsd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.contactsd") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.backupd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.nfcd.hwmanager") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.cdp.daemon") + (global-name "com.apple.cloudd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.carousel.sessionservice") +(global-name "com.apple.health.records") +(global-name "com.apple.healthlited.hummingbird") +(global-name "com.apple.locationd.smoother")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.awdd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.companionsync") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilephone") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.ET") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.dt.Xcode") +(preference-domain "com.apple.healthlite")) + (preference-domain "com.apple.mmcs") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.nanoprefsyncd") + (require-any (preference-domain "com.apple.Fitness") +(preference-domain "com.apple.nanolifestyle") +(preference-domain "com.apple.nanolifestyle.privacy") +(preference-domain "com.apple.SOS")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.ET") + (require-any (preference-domain "com.apple.Fitness") +(preference-domain "com.apple.nanolifestyle") +(preference-domain "com.apple.nanolifestyle.privacy") +(preference-domain "com.apple.SOS"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/healthd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb new file mode 100644 index 0000000..9a8707e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb @@ -0,0 +1,641 @@ +(version 1) +(deny default) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (subpath "/usr/libexec/DataModel.momd") +(subpath "/private/var/mobile/Library/Logs")) + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (require-any (subpath "/private/var/root/Documents") +(literal "/private/var/mobile/Library/Preferences/com.apple.internal.honeybeed.plist") +(literal "/private/var/mobile/Library/Preferences/com.apple.Honeybee.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/honeybeed.internal") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (require-any (literal "/usr/local/bin/gzip") +(literal "/usr/bin/bsdtar") +(literal "/usr/bin/bzip2") +(literal "/usr/bin/tar") +(literal "/usr/bin/split")) + (subpath "/usr/local/lib") + (subpath "/AppleInternal") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/honeybeed.internal") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath "/private/var/root/Documents") +(literal "/private/var/mobile/Library/Preferences/com.apple.internal.honeybeed.plist") +(literal "/private/var/mobile/Library/Preferences/com.apple.Honeybee.plist")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/honeybeed.internal")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/honeybeed.internal")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.internal.honeybeed") +(preference-domain "com.apple.Honeybee")) + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.internal.honeybeed") +(preference-domain "com.apple.Honeybee"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb.xml new file mode 100644 index 0000000..2cf04bc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/honeybeed.sb.xml @@ -0,0 +1,36 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb new file mode 100644 index 0000000..0d524bd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb @@ -0,0 +1,285 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.foundation.upload-prep.read-write") + (require-any + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.foundation.upload-prep.read-write") + (require-any + (subpath "/private/var/tmp") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iWorkXPC.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb new file mode 100644 index 0000000..5aa35c1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb @@ -0,0 +1,412 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin") + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.homesharing") + (preference-domain "com.apple.TelephonyUtilities") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carplay") + (preference-domain "com.apple.PeoplePicker") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd")) + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iapd") + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb.xml new file mode 100644 index 0000000..9cd646a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iapd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb new file mode 100644 index 0000000..cd08690 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb @@ -0,0 +1,727 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Caches/com.apple.setmme") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") +(literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") +(subpath-prefix "${HOME}/Library/IdentityServices") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}")) + (extension "com.apple.identityservices.send") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/AppleInternal") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (require-any + (require-any (literal "/usr/bin/lskq") +(literal "/usr/local/bin/figplaySS") +(literal "/usr/local/bin/netdiagnose") +(literal "/usr/sbin/lsof") +(literal "/bin/sh")) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (subpath "/usr/local/lib"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") +(literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") +(subpath-prefix "${HOME}/Library/IdentityServices") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.identityservices.send") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.awdd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.wirelessproxd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.fairplayd") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.asd.scoring") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (34 a381 a080 8e67) + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.tccd") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.datamigrator") + (global-name-regex #"-idswake$" #".+-idswake$") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.idscredentialsagent.embedded.auth") +(global-name "com.apple.imtransferservices.IMTransferAgent")) + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow network-inbound + (local ip "*:*")) +(allow network-outbound + (remote ip "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.migration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.da") + (require-any (preference-domain "com.apple.Messages") +(preference-domain "com.apple.registration")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.identityservicesd") +(preference-domain "com.apple.identityservices.idstatuscache") +(preference-domain "com.apple.ids.deviceproperties") +(preference-domain "com.apple.ids.subservices")) + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.identityservicesd") +(preference-domain "com.apple.identityservices.idstatuscache") +(preference-domain "com.apple.ids.deviceproperties") +(preference-domain "com.apple.ids.subservices")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.conference")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/identityservicesd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb new file mode 100644 index 0000000..516f1b5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb @@ -0,0 +1,426 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/usr/libexec/installd") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath "/private/var/installd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/MobileIdentityData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (literal "/com.apple.xpc.launchd.bootstrap.plist"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/installd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (subpath "/private/var/containers/Bundle") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "installd.firstboot_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.misagent") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/installd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb new file mode 100644 index 0000000..a91fb54 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb @@ -0,0 +1,292 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/private/var/iomfb_bics_daemon") +(subpath "/private/var/hardware") +(literal "/dev/disk1") +(literal "/dev/disk3")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/iomfb_bics_daemon") +(subpath "/private/var/hardware") +(literal "/dev/disk1") +(literal "/dev/disk3")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleEmbeddedTouchEEPROMDriverUC") + (iokit-user-client-class "AppleSEPUserClient")) +(allow iokit-set-properties + (iokit-user-client-class "AppleNVMeController") + (iokit-user-client-class "AppleSEPUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "iomfb_bics_daemon.started")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/iomfb_bics.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb new file mode 100644 index 0000000..76db1cc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb @@ -0,0 +1,748 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media/Downloads")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Media") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.itunesstored") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/Snapshots") +(subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/MusicLibrary") +(literal-prefix "${HOME}/Library/")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Media") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.itunesstored") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/Snapshots") +(subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/MusicLibrary") +(literal-prefix "${HOME}/Library/")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.logger") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ondemandd.itunesstored") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.networkd") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.cache_delete") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.lsd.xpc") + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.installd") + (34 a381 a080 495d) + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.homesharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itunesstored")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/itunesstored.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb new file mode 100644 index 0000000..472ebec --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb @@ -0,0 +1,1258 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-entitlement "com.apple.private.librarian.container-proxy") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+[.]appex/" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+[.]appex$" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+[.]appex/" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+[.]appex$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath "/private/var/MobileAsset/Assets/com_apple_MobileAsset_LinguisticData") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Keyboard") +(subpath-prefix "${HOME}/Library/KeyboardServices") +(subpath-prefix "${HOME}/Library/LanguageModeling") +(subpath-prefix "${HOME}/Library/Mobile Documents/com~apple~TextInput")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${HOME}/Library/ResponseKit") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.kbd") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.kbd")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.kbd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (vnode-type SYMLINK) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.kbd") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-any + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-any + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type SYMLINK) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))))) + (require-all + (vnode-type SYMLINK) + (require-any + (subpath-prefix "${HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/ResponseKit") + (require-any (subpath-prefix "${HOME}/Library/Keyboard") +(subpath-prefix "${HOME}/Library/KeyboardServices") +(subpath-prefix "${HOME}/Library/LanguageModeling") +(subpath-prefix "${HOME}/Library/Mobile Documents/com~apple~TextInput")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (literal-prefix "${HOME}/Library/CoreDuet/Knowledge/knowledgeC.db-shm") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.revisiond.staging") + (require-any + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.kbd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.kbd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.kbd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/CloudKit/com.apple.kbd") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AGXCommandQueue") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AGXSharedUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.revisiond") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.suggestd.contacts") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.networkd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contacts.donation.agent") + (global-name "com.apple.bird.token") + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.calaccessd") + (global-name "com.apple.healthd.server") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.InputModePreferences") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.kbd") +(preference-domain "com.apple.textInput.keyboardServices.textReplacement")) + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.spotlightui") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.kbd") +(preference-domain "com.apple.textInput.keyboardServices.textReplacement")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.routetable.") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb.xml new file mode 100644 index 0000000..d06b1e5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/kbd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb new file mode 100644 index 0000000..d73225c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb @@ -0,0 +1,706 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable")))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (require-not (ipc-posix-name "apple.shm.notification_center")) + (ipc-posix-name "apple.cfprefs."))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (34 aae0 a080 464d) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.frontboard.systemappservices") + (34 ab2e a080 4644) + (global-name "com.apple.ibooks.BLService") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.UIKit.statusbarserver") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-not (34 a381 4655 a081)) + (require-any + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (global-name "com.apple.system.notification_center")) + (require-any + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e8d) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.logd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))))))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$"))) +(allow network-outbound + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb.xml new file mode 100644 index 0000000..aaa0d47 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/keyboard.sb.xml @@ -0,0 +1,31 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb new file mode 100644 index 0000000..47ea0af --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb @@ -0,0 +1,441 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad.limitadtrackingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad.limitadtrackingd") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/usr/libexec/limitadtrackingd")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.cloudd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.AdSheetPhone.management") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/limitadtrackingd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb new file mode 100644 index 0000000..6005fbc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb @@ -0,0 +1,514 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/private/var/db/timezone") + (subpath "/private/var/run/lockdown") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (require-any (subpath "/private/var/root/Library/Lockdown") +(literal "/private/var/root/Library/Preferences/com.apple.mobile.lockdownd.plist") +(subpath "/private/var/preferences/SystemConfiguration")) + (literal "/private/var/run/lockdown.sock") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/private/var/logs") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath "/Applications/Preferences.app") +(subpath "/AppleInternal/Lockdown") +(literal "/usr/libexec/lockdownd") +(literal "/private/var/db/launchd.db/com.apple.launchd/overrides.plist")) + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${FRONT_USER_HOME}/Media") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/Applications") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.WebAppCache") +(subpath-prefix "${FRONT_USER_HOME}/Library/Calendar") +(subpath-prefix "${FRONT_USER_HOME}/Library/Notes") +(subpath-prefix "${FRONT_USER_HOME}/Library/Voicemail")) + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Media") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Containers") + (vnode-type DIRECTORY)) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (vnode-type DIRECTORY)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/containers") + (vnode-type DIRECTORY)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Media") + (require-any (subpath "/private/var/root/Library/Lockdown") +(literal "/private/var/root/Library/Preferences/com.apple.mobile.lockdownd.plist") +(subpath "/private/var/preferences/SystemConfiguration")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/run/lockdown.sock") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/private/var/run/lockdown") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/logs") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (literal "/private/var/db/timezone") + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleEffaceableStorageUserClient") +(iokit-user-client-class "AppleNANDFTLUserClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "auto-boot")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.syslog_relay") +(global-name "com.apple.streaming_zip_conduit") +(global-name "com.apple.mobile.notification_proxy") +(global-name "com.apple.mobile.insecure_notification_proxy") +(global-name "com.apple.mobile.installation_proxy") +(global-name "com.apple.mobile.assertion_agent") +(global-name "com.apple.AOSNotification") +(global-name "com.apple.crash_mover") +(global-name "com.apple.crashreportcopymobile") +(global-name "com.apple.atc2") +(global-name "com.apple.afcd") +(global-name "lockdown.")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.ait.client") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.atc") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.webinspector") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.mobile.installd") + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound + (local tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/run/lockdown")) +(allow network-outbound + (literal "/private/var/run/lockbot")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lockdownd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb new file mode 100644 index 0000000..721a231 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb @@ -0,0 +1,562 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/oslog")) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.logd.read-only") + (require-any + (subpath "/private/var/db/diagnostics") + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (subpath "/private/var/db/uuidtext"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/uuidtext") + (subpath "/private/var/db/timezone") + (subpath "/private/var/db/diagnostics") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/private/var/logs") + (literal "/dev/oslog") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/usr/libexec") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath "/private/var/log") +(subpath "/private/var/root/Library/Logs")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (file-mode #o0100) + (file-mode #o0010) + (file-mode #o0001))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/userdata") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/uuidtext") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/diagnostics") + (extension "com.apple.app-sandbox.read-write") + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath "/private/var/logs/system_logs.logarchive") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal "/private/var/userdata") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/oslog") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-any (subpath "/private/var/log") +(subpath "/private/var/root/Library/Logs")) + (subpath "/private/var/logs") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs")) +(allow file-write-xattr + (xattr "com.apple.logd.metadata") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-priv-host-port) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-kext-query) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb.xml new file mode 100644 index 0000000..034577f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/logd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb new file mode 100644 index 0000000..0cb7769 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb @@ -0,0 +1,467 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath-prefix "${HOME}/Library/Logs/useractivityd") +(subpath-prefix "${HOME}/Library/Logs/Handoff") +(subpath-prefix "${HOME}/Library/Logs/Transport")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/useractivityd") +(subpath-prefix "${HOME}/Library/Logs/Handoff") +(subpath-prefix "${HOME}/Library/Logs/Transport")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.marco") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coreservices.uauseractivitypasteboardclient.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.analyticsd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mobileipod") + (require-any (preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites") +(preference-domain "com.apple.coreservices.useractivityd")) + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mediaremote") + (require-any (preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites") +(preference-domain "com.apple.coreservices.useractivityd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb.xml new file mode 100644 index 0000000..8a6c1dd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/lsuseractivityd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb new file mode 100644 index 0000000..6a61401 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb @@ -0,0 +1,151 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/aes_0") + (literal "/dev/bpf")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (require-any (regex #"/private/var/folders/[^/]+/[^/]+/C/mds/?") +(regex #"/private/var/folders/[^/]+/[^/]+/-Caches-/mds/?")) + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/run/mDNSResponder") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/db/dyld")))) +(allow file-read-data + (require-any (literal "/private/var/db/crls/crlcache.db") +(subpath "/private/var/db/mds") +(subpath "/private/var/tmp/mds") +(literal "/Library/Keychains/System.keychain")) + (require-all + (require-not (literal "/Library/Keychains/")) + (require-any + (literal "/dev/console") + (require-any (literal "/usr/sbin/mDNSResponder") +(literal "/Library/Preferences/com.apple.mDNSResponder.plist") +(literal "/Library/Preferences/com.apple.crypto.plist") +(literal "/Library/Preferences/com.apple.security.") +(literal "/Library/Preferences/SystemConfiguration/preferences.plist") +(literal "/Library/Preferences/SystemConfiguration/com.apple.nat.plist") +(literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") +(subpath "/Library/Preferences/Logging") +(literal "/Library/Preferences/ByHost/.GlobalPreferences.") +(literal "/Library/Preferences/.GlobalPreferences.") +(literal "/Library/Security/Trust Settings/Admin.plist") +(literal "/private/etc") +(subpath "/private/var/preferences/Logging/Subsystems") +(subpath "/AppleInternal/Library/Preferences/Logging") +(subpath "/System/Library/Preferences/Logging")) + (literal "/private/etc/hosts") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/usr/sbin") + (subpath "/private/var/db/timezone")))) +(allow file-read-metadata) +(allow file-test-existence) +(allow file-write* + (require-any (regex #"/private/var/folders/[^/]+/[^/]+/C/mds/?") +(regex #"/private/var/folders/[^/]+/[^/]+/-Caches-/mds/?")) + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (literal "/private/var/run/mDNSResponder") + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (require-all + (file-mode #o0000) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/console") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))) +(allow iokit-open + (require-any (iokit-user-client-class "NVEthernetUserClientMDNS") +(iokit-user-client-class "mDNSOffloadUserClient") +(iokit-user-client-class "wlDNSOffloadUserClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.snhelper") + (global-name "com.apple.awdd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mDNSResponderHelper") + (global-name "com.apple.securityd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (34 a381 a080 43e3) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.bsd.dirhelper") +(global-name "com.apple.bluetoothd") +(global-name "com.apple.blued") +(global-name "com.apple.distributed_notifications.2") +(global-name "com.apple.mDNSResponder_Helper") +(global-name "com.apple.webcontentfilter.dns") +(global-name "com.apple.awacs")) + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.ocspd") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.SecurityServer") +(global-name "com.apple.coreservices.quarantine-resolver"))) +(allow mach-register + (global-name "com.apple.d2d.ipc")) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb.xml new file mode 100644 index 0000000..cc8e01a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mDNSResponder.sb.xml @@ -0,0 +1,56 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb new file mode 100644 index 0000000..7e89f68 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb @@ -0,0 +1,745 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-read* + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Library/Audio/Tunings/Generic/AU") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath "/usr/local/lib") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.tcc.kTCCServicePhotos") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AGXDevice")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aae0 a080 42c5) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.audio.AudioComponentRegistrar") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.xpc.activity.unmanaged") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 42bf) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.distributed_notifications@1v3") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (global-name "com.apple.pegasus") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.audio.AudioSession"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mediaanalysis") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaanalysisd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.corevideo"))) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.mobileslideshow") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaanalysisd") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaanalysisd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb new file mode 100644 index 0000000..7e46064 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb @@ -0,0 +1,1083 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.rtcreporting.upload") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/usr/local/lib/libAudioDiagnostics.dylib") + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (subpath "/Library/Audio/Plug-Ins") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (extension "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.sandbox.executable") + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (require-any (subpath "/Library") +(subpath "/usr/local/share/firmware/isp") +(literal "/private/var/Managed Preferences/mobile/com.apple.springboard.plist") +(literal "/AppleInternal/Library/Conference/Environments.plist")) + (extension "com.apple.mediaserverd.read") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-mediaserverd.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") +(literal-prefix "${HOME}/Library/Logs/AirPlay.log") +(literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") +(subpath-prefix "${HOME}/Library/FaceKitVault") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/Downloads") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/iTunes_Control/Music") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/PhotoData/OutboundSharingTmp") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/tmp/mediaserverd") +(subpath "/private/var/logs/mediaserverd") +(literal-prefix "${PROCESS_TEMP_DIR}/AirTunesHALPlugin.log")) + (subpath-prefix "${HOME}/Media/DCIM") + (subpath "/usr/sbin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/Podcasts") + (subpath "/usr/share") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/Recordings") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (literal "/usr/sbin/mediaserverd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/local/lib") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mediaserverd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mediaserverd")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-read-data + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${HOME}/Library/Caches/CoreMotion") +(literal-prefix "${HOME}/Library/Logs")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.mediaserverd.read") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/Podcasts") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/wireless/Library/Logs/awd") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-mediaserverd.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") +(literal-prefix "${HOME}/Library/Logs/AirPlay.log") +(literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") +(subpath-prefix "${HOME}/Library/FaceKitVault") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/Downloads") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/iTunes_Control/Music") +(subpath-prefix "${HOME}/Library/FaceKitVaultMedia/PhotoData/OutboundSharingTmp") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/tmp/mediaserverd") +(subpath "/private/var/logs/mediaserverd") +(literal-prefix "${PROCESS_TEMP_DIR}/AirTunesHALPlugin.log")) + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mediaserverd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mediaserverd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${HOME}/Library/Caches/CoreMotion") +(literal-prefix "${HOME}/Library/Logs")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (require-any (iokit-user-client-class "AppleUSBHostInterfaceUserClient") +(iokit-user-client-class "IOAccessoryManagerUserClient")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (require-any (iokit-user-client-class "com_apple_audio_IOBorealisOwlUserClient") +(iokit-user-client-class "AppleAOPAudioUserClient") +(iokit-user-client-class "AppleAOPVoiceTriggerUserClient") +(iokit-user-client-class "AppleAVDUserClient") +(iokit-user-client-class "AppleAVEUserClient") +(iokit-user-client-class "AppleAVE2UserClient") +(iokit-user-client-class "AppleD5500UserClient") +(iokit-user-client-class "AppleExternalAmpControllerUserClient") +(iokit-user-client-class "AppleH4CamInUserClient") +(iokit-user-client-class "AppleH6CamInUserClient") +(iokit-user-client-class "AppleH9CamInUserClient") +(iokit-user-client-class "AppleH10CamInUserClient") +(iokit-user-client-class "AppleVXD393UserClient") +(iokit-user-client-class "AppleVXD390UserClient") +(iokit-user-client-class "AppleVXD375UserClient") +(iokit-user-client-class "AppleVXE380UserClient") +(iokit-user-client-class "AppleSRSDriverUserClient") +(iokit-user-client-class "AppleSPUHIDDriverUserClient") +(iokit-user-client-class "AUCUserClient") +(iokit-user-client-class "IOUSBDeviceInterfaceUserClient") +(iokit-user-client-class "IOTimeSyncDomainUserClient") +(iokit-user-client-class "IOTimeSyncgPTPManagerUserClient") +(iokit-user-client-class "IOTimeSyncNetworkPortUserClient") +(iokit-user-client-class "IOTimeSyncClockManagerUserClient") +(iokit-user-client-class "IOTimeSyncUserClient") +(iokit-user-client-class "IOStreamAudioUserClient") +(iokit-user-client-class "IOReportUserClient") +(iokit-user-client-class "IOAudioCodecsUserClient") +(iokit-user-client-class "IOAudio2TransformerUserClient") +(iokit-user-client-class "IOAudio2DeviceUserClient") +(iokit-user-client-class "H3H264VideoEncoderDriverUserClient")) + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "shm_pcm_audio_sco_write") +(ipc-posix-name "shm_pcm_audio_sco_read")) + (require-any (ipc-posix-name "shm_pcm_audio_acl") +(ipc-posix-name "com.apple.audio.abl.")) + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name-regex #"^[0-9A-F][0-9A-F]:+[0-9A-F][0-9A-F]-tacl$") + (ipc-posix-name-regex #"^AppleAURemoteIO[.]." #"^AppleAURemoteIO[.].+") + (ipc-posix-name-regex #"^shm_notif[.][^.]+[.][RW]$") + (ipc-posix-name-regex #"^AppleAudioQueue[.]." #"^AppleAudioQueue[.].+")) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.NetworkLinkConditioner") +(global-name "com.apple.accessories.audio") +(global-name "com.apple.airplay.receiver.controller") +(global-name "com.apple.applecamerad") +(global-name "com.apple.audio.AUPBRegistrar") +(global-name "com.apple.b184_mcu_commd") +(global-name "com.apple.b184_monitord") +(global-name "com.apple.carkit.monitoring.service") +(global-name "com.apple.coremedia.virtualdisplayserver") +(global-name "com.apple.filesystems.userfsd") +(global-name "com.apple.internal.mediaserverdtracerd") +(global-name "com.apple.lskdmsed") +(global-name "com.apple.mediaanalysisd.realtime") +(global-name "com.apple.securekeyvaultd")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.mediaremoted.xpc") + (require-any (global-name "com.apple.accessories.transport-server") +(global-name "com.apple.iap2d.xpc") +(global-name "com.apple.iapd.xpc")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (34 aae0 a080 4113) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.logd.events") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (global-name "com.apple.lskdd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.rtcreportingd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.symptom_diagnostics") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.homed.xpc") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.timed.xpc") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PowerManagement.control") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (34 a381 a080 4111) + (global-name "com.apple.SharingServices") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.tccd") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.carkit.service") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.iap2d.distributednotification.server") +(global-name "com.apple.iapd.distributednotification.server") +(global-name "com.apple.iaptransportd.xpc")) + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow mach-register + (global-name "com.apple.midiserver.io") + (global-name "com.apple.coremedia.") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:*") + (literal "/private/var/run/lockdown.sock") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder") + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.voicetrigger.notbackedup") +(preference-domain "com.apple.audio.puffin") +(preference-domain "com.apple.audio.virtualaudio") +(preference-domain "com.apple.coremedia.bag") +(preference-domain "com.apple.facetime")) + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.mediaserverd") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.da") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.quic") +(preference-domain "com.apple.settings.bluetooth.audio-route")) + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.carplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.rtcreporting") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.mediaserverd") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.celestial") + (require-any (preference-domain "com.apple.voicetrigger.notbackedup") +(preference-domain "com.apple.audio.puffin") +(preference-domain "com.apple.audio.virtualaudio") +(preference-domain "com.apple.coremedia.bag") +(preference-domain "com.apple.facetime")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-exec* + (literal "/usr/sbin/mediaserverd") + (require-all + (require-any (literal "/usr/bin/trace") +(literal "/usr/bin/syslog")) + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl* + (sysctl-name "kern.min_audio_buffer_usec")) +(allow sysctl-read + (sysctl-name "kern.min_audio_buffer_usec") + (sysctl-name "net.routetable.") + (sysctl-name "kern.bootsessionuuid") + (sysctl-name "sysctl.proc_native") + (sysctl-name "vm.vm_page_free_target") + (extension "com.apple.security.exception.sysctl.read-only") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (debug-mode) + (sysctl-name "vm.footprint_suspend")) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb.xml new file mode 100644 index 0000000..54e204c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mediaserverd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb new file mode 100644 index 0000000..cfe3dec --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb @@ -0,0 +1,317 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.system.notification_center") + (require-any + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e8d) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.logd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb.xml new file mode 100644 index 0000000..302e6ac --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/message-filter.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb new file mode 100644 index 0000000..3ca4fc1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb @@ -0,0 +1,611 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable")))) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (literal "/usr/libexec") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/usr/libexec/mobile_house_arrest") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/GeoJSON$"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.securityd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (literal "/private/var/run/lockdown/checkin")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile-house-arrest.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb new file mode 100644 index 0000000..51d918b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb @@ -0,0 +1,429 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/disk")) +(allow file-link) +(allow file-mount + (subpath "/Developer") + (require-any (subpath "/private/var/factory_mount") +(subpath "/private/var/personalized_automation") +(subpath "/private/var/personalized_factory") +(subpath "/private/var/personalized_demo") +(subpath "/private/var/personalized_debug"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/run/mobile_image_mounter") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/private/etc/master.passwd") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/private/var/factory_mount") +(subpath "/private/var/personalized_automation") +(subpath "/private/var/personalized_factory") +(subpath "/private/var/personalized_demo") +(subpath "/private/var/personalized_debug")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/dev") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/factory_mount") +(subpath "/private/var/personalized_automation") +(subpath "/private/var/personalized_factory") +(subpath "/private/var/personalized_demo") +(subpath "/private/var/personalized_debug")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/run/mobile_image_mounter") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Developer") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleMobileApNonceUserClient") +(iokit-user-client-class "IOHDIXControllerUserClient")) + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-get-properties) +(allow job-creation) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-fsctl + (fsctl-command (_IO "A" 1))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb.xml new file mode 100644 index 0000000..2aae38a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_mounter.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb new file mode 100644 index 0000000..2efb3a8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb @@ -0,0 +1,399 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/run/mobile_image_mounter") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/run/mobile_image_mounter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.mobile.storage_mounter.xpc") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobile_storage_proxy.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb new file mode 100644 index 0000000..1303722 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb @@ -0,0 +1,660 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/mad") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (subpath-prefix "${HOME}/Library/Logs/mobileactivationd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/mad") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "ProvInfoIOKitUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.nehelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.icloud.findmydeviced") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.managedconfiguration.profiled") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (remote tcp "*:443") + (remote tcp "*:80") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (debug-mode) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileactivationd") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.mobileactivationd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileactivationd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb new file mode 100644 index 0000000..c4520e9 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb @@ -0,0 +1,710 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (literal "/private/var/MobileAsset/AssetsV2/SplunkRecords/")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/private/var/MobileAsset"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.assets.read") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/MobileAsset") + (require-any (literal "/private/var/root/Library/Cookies") +(literal "/private/var/root/Library/Cookies/Cookies.binarycookies") +(literal "/private/var/root/Library/Preferences/com.apple.MobileAsset.plist")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/private/var/root/Library/Preferences/com.apple.WebFoundation.plist") +(literal "/private/var/Managed Preferences/mobile/com.apple.MobileAsset.plist") +(literal "/usr/libexec/mobileassetd") +(subpath "/AppleInternal/Library/PreinstalledAssets")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.mobileassetd")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/MobileAsset") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal "/private/var/root/Library/Cookies") +(literal "/private/var/root/Library/Cookies/Cookies.binarycookies") +(literal "/private/var/root/Library/Preferences/com.apple.MobileAsset.plist")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileassetd"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.cache_delete") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.installcoordinationd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.security.ut.updatetransparencyd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AssetCacheLocator") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.MobileAsset")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb.xml new file mode 100644 index 0000000..98518bf --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/mobileassetd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb new file mode 100644 index 0000000..278b5aa --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb @@ -0,0 +1,770 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/preferences/Logging") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY))) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps$") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")))) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-test-existence) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.Maps.SpringBoard") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.Maps.IPC") +(global-name "com.apple.Maps.gsEvents")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.marco") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.MapsSupport")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nanomapscd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb new file mode 100644 index 0000000..a590a09 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb @@ -0,0 +1,582 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.MapsSupport") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.MapsSupport")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.MapsSupport") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.MapsSupport")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nanomaps.xpc.GeoServices.Navigation") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.routined.registration") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.assistant.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.MapsSupport") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/navd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb new file mode 100644 index 0000000..5d69789 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb @@ -0,0 +1,458 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (require-any + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/dev/ptmx") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ibooks.BLService") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (34 a381 4655 a081) + (require-any + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.system.notification_center") + (require-any + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e8d) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.logd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb.xml new file mode 100644 index 0000000..302e6ac --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/network-filter.sb.xml @@ -0,0 +1,32 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb new file mode 100644 index 0000000..bd1df3b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb @@ -0,0 +1,480 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/tty.stockholm")) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath "/private/var/containers/Bundle") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal "/usr/libexec/nfcd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath "/private/var/logs/WirelessLibraryLogs") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleCredentialManagerUserClient") + (require-any (iokit-user-client-class "ApplePPMUserClient") +(iokit-user-client-class "AppleStockholmControlUserClient")) + (iokit-user-client-class "AppleSSEUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.analyticsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 7e38) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.appstored.xpc.updates") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (control-name "com.apple.uart.stockholm")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "nfcd") +(preference-domain "com.apple.nfcd.nfttr")) + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.stockholm") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Duet") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "nfcd") +(preference-domain "com.apple.nfcd.nfttr")) + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-socket + (socket-domain AF_SYSTEM)) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nfcd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb new file mode 100644 index 0000000..475b595 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb @@ -0,0 +1,148 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.pfd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb.xml new file mode 100644 index 0000000..e14b98f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nlcd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb new file mode 100644 index 0000000..433b13c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb @@ -0,0 +1,5 @@ +(version 1) +(allow default) +(deny file-write-setugid) +(deny network* + (local ip "*:*")) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb.xml new file mode 100644 index 0000000..12f6fae --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nointernet.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb new file mode 100644 index 0000000..9ca7013 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb @@ -0,0 +1,789 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets")))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-all (require-not (subpath "/private/var/logs/MobileLibraryLogs")) +(require-not (subpath "/private/var/logs/MobileMediaFactoryLogs"))) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Media/Downloads") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/usr/libexec") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond-launchd")) + (literal "/usr/libexec/nsurlsessiond") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.coremedia")) + (require-any + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/ptmx") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-all (require-not (subpath "/private/var/logs/MobileLibraryLogs")) +(require-not (subpath "/private/var/logs/MobileMediaFactoryLogs"))) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Media/Downloads") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond-launchd")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/")))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/"))))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.trustd") + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.cache_delete.public") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coremedia.assetdownloader") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.coreduetd") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.installcoordinationd") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ocspd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-all + (require-not (global-name "com.apple.CARenderServer")) + (require-any + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.diagnosticd") + (34 a381 a080 60f3) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.containermanagerd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")))) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.nsurlsessiond") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.Duet") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.nsurlsessiond")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlsessiond.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb new file mode 100644 index 0000000..fe8a2b4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb @@ -0,0 +1,534 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (literal-prefix "${HOME}") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (require-any (literal-prefix "${HOME}/Applications") +(literal-prefix "${HOME}/Containers")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.nsurlstorage.extension-cache") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/libexec") + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.nsurlstoraged") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.nsurlstoraged")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/nsurlstoraged.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb new file mode 100644 index 0000000..d3c675e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb @@ -0,0 +1,478 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/MobileDevice") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/usr/libexec/online-auth-agent") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/MobileIdentityData") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/MobileDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/MobileIdentityData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAESAcceleratorUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.misagent") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (remote ip "*:*")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/online-auth-agent.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb new file mode 100644 index 0000000..2d3a038 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb @@ -0,0 +1,726 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/News.app") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-journal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-shm") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-wal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/share") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/DifferentialPrivacy/Reports") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.DataDetectorsSourceAccess") +(global-name "com.apple.dprivacyd") +(global-name "com.apple.networkserviceproxy") +(global-name "com.apple.siri.vocabularyupdates")) + (global-name "com.apple.VideoSubscriberAccount.videosubscriptionsd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 3698) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.managedconfiguration.profiled") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.private.bmk.allow" + (require-any + (global-name "com.apple.biometrickitd") + (global-name "com.apple.pearld"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.lookup.shared") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.parsecd") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.parsecd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/parsecd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb new file mode 100644 index 0000000..4c0ef08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb @@ -0,0 +1,1119 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-entitlement "com.apple.private.librarian.container-proxy") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-any + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.librarian.ubiquity-container") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/Developer") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.passd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.passd")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.passd") +(subpath-prefix "${HOME}/Library/Passes") +(subpath-prefix "${HOME}/Library/Caches/PassKit")) + (literal "/dev/aes_0") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (literal "/private/var/run/syslog") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.passd") +(subpath-prefix "${HOME}/Library/Passes") +(subpath-prefix "${HOME}/Library/Caches/PassKit")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.passd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.passd")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.stockholm.plist")) + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "reportStatusMessages")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nfcd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.networkd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.GSSCred") + (global-name "com.apple.seld.tsmmanager") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.seld") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.biometrickitd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.CoreAuthentication.daemon") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.pluginkit.pkd")) + (require-any + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.NPKCompanionAgent.Server") +(global-name "com.apple.hsa-authentication-server") +(global-name "com.apple.passes.usage") +(global-name "com.apple.springboard.carditemscontroller") +(global-name "com.apple.AdSheetPhone.analytics")) + (global-name "com.apple.contactsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.securityd") + (global-name "com.apple.icloud.findmydeviced") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.FSEvents") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.bird.token") + (global-name "com.apple.asd.scoring") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.FileProvider") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 350d) + (global-name "com.apple.SharingServices") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))))) +(allow network-outbound + (remote ip "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.biometrickitd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.LocalAuthentication") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.Security") + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (require-any (preference-domain "com.apple.Passbook") +(preference-domain "com.apple.PassKit") +(preference-domain "com.apple.PassKit.passes") +(preference-domain "com.apple.passd")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.Passbook") +(preference-domain "com.apple.PassKit") +(preference-domain "com.apple.PassKit.passes") +(preference-domain "com.apple.passd")) + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb.xml new file mode 100644 index 0000000..8635cc4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/passd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb new file mode 100644 index 0000000..af99317 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb @@ -0,0 +1,638 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Personas") + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (literal "/usr/local/bin") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (literal "/usr/local/bin/prtool") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Personas") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.marco") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/personad.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb new file mode 100644 index 0000000..4c0940d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb @@ -0,0 +1,199 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/pfm")) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (require-any (literal "/usr/libexec/pfd") +(literal "/dev/pfm")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write-data + (literal "/dev/pfm")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-cross-domain-lookup) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb.xml new file mode 100644 index 0000000..b22cedd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pfd.sb.xml @@ -0,0 +1,28 @@ + + + + + + + + + +]> + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb new file mode 100644 index 0000000..6a56cfb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb @@ -0,0 +1,816 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd") + (require-all + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AGXCommandQueue") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AGXGLContext") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "AGXSharedUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (34 aae0 a080 329a) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.securityd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.calaccessd") + (global-name "com.apple.routined.registration") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.photoanalysisd") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.photoanalysisd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb.xml new file mode 100644 index 0000000..d06b1e5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/photoanalysisd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb new file mode 100644 index 0000000..9309e6b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb @@ -0,0 +1,114 @@ +(version 1) +(allow default) +(deny file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))) + (require-all + (extension "com.apple.sandbox.executable") + (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(deny file-mount) +(deny file-mount-update) +(deny file-read* + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]")) + (require-all + (require-all (require-not (subpath "/System/Library/Frameworks")) +(require-not (subpath "/System/Library/PrivateFrameworks"))) + (require-not (subpath "/private/var/preferences/Logging")) + (require-not (subpath "/System/Library")) + (require-not (subpath "/usr/lib")) + (require-not (subpath "/usr/share")) + (require-not (subpath "/private/var/db/timezone")) + (require-all (require-not (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) +(require-not (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) +(require-not (literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist"))) + (require-not (extension "com.apple.app-sandbox.read")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-only")) + (require-not (subpath "/Developer")) + (require-not (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist")) + (require-not (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist")) + (require-not (extension "com.apple.app-sandbox.read-write")) + (require-not (extension "com.apple.sandbox.executable")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-only")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")) + (require-entitlement "com.apple.security.system-groups") + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]")))) + (require-all + (require-all (require-not (literal "/dev/zero")) +(require-not (literal "/dev/null"))) + (require-all (require-not (subpath "/private/var/db/datadetectors/sys")) +(require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library"))) + (require-all (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo"))) + (require-not (literal "/dev/dtracehelper")) + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-not (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist")) + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(deny file-read-data + (require-all + (extension "com.apple.sandbox.executable") + (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/"))) +(deny file-unmount) +(deny file-write* + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (require-all + (require-not (literal "/private/var/db/PlugInKit-Annotations")) + (require-not (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-not (extension "com.apple.security.exception.files.absolute-path.read-write")) + (require-not (extension "com.apple.security.exception.files.home-relative-path.read-write")) + (require-not (extension "com.apple.app-sandbox.read-write")) + (require-any + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/[.]com[.]apple[.]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(deny file-write-create + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private"))) +(deny file-write-data + (require-all + (require-not (literal "/dev/ptmx")) + (require-not (literal "/dev/aes_0")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")))) +(deny file-write-setugid) +(deny job-creation) +(deny nvram*) +(deny nvram-delete) +(deny nvram-get) +(deny nvram-set) +(deny process-info*) +(deny process-info-listpids) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb.xml new file mode 100644 index 0000000..f77bfb4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/pkd.sb.xml @@ -0,0 +1,31 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb new file mode 100644 index 0000000..ed68786 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb @@ -0,0 +1,650 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")) + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable")))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.application-group") + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (require-all + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (require-entitlement "com.apple.private.amfi.can-load-cdhash"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/"))) +(allow network-outbound + (require-all + (subpath-prefix "${HOME}") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/"))) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb.xml new file mode 100644 index 0000000..f773995 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/playground-devtools.sb.xml @@ -0,0 +1,27 @@ + + + + + + + + + +]> + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb new file mode 100644 index 0000000..f3468ca --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb @@ -0,0 +1,277 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/powerlog") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/BatteryLife")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/powerlog") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/BatteryLife")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/powerlogd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb new file mode 100644 index 0000000..aa8ed98 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb @@ -0,0 +1,645 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/run/printd") +(subpath-prefix "${HOME}/Library/com.apple.printd")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/com.apple.printd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/printd") + (extension "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (process-attribute 4) + (require-any + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath "/private/var/run/printd") +(subpath-prefix "${HOME}/Library/com.apple.printd")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AGXDevice") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.springboard.services") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (literal "/private/var/run/lockdown.sock") + (remote tcp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.printd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.CFNetwork") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.printd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/printd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb new file mode 100644 index 0000000..9228182 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb @@ -0,0 +1,461 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ProgressKit") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.progressd")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.progressd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/ProgressKit") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/.ProgressKit") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.cloudd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/progressd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb new file mode 100644 index 0000000..7fe0a47 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb @@ -0,0 +1,483 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Media") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.metal")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.metal")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (literal "/private/etc/hosts") + (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.metal") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.metal")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.metal")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coremedia") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.camera") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.ImageCaptureFramework") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileslideshow") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb.xml new file mode 100644 index 0000000..95bc3ef --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/ptpd.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb new file mode 100644 index 0000000..57883e4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb @@ -0,0 +1,201 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/db/timezone") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb.xml new file mode 100644 index 0000000..aaa0d47 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-preview.sb.xml @@ -0,0 +1,31 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb new file mode 100644 index 0000000..aac3073 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb @@ -0,0 +1,13 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb.xml new file mode 100644 index 0000000..aaa0d47 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklook-thumbnail.sb.xml @@ -0,0 +1,31 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb new file mode 100644 index 0000000..b571282 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb @@ -0,0 +1,1173 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (extension-class "com.apple.quicklook.readonly") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (require-any + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.quicklook.readonly") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.app-sandbox.read")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.odr-assets") + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks"))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath "/System/Library/Frameworks/QuickLook.framework/PlugIns/QLWebKitBundle.wkbundle") + (extension-class "com.apple.app-sandbox.read"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/System/Library") + (subpath "/AppleInternal/Library/Frameworks/TypologyRecording.framework") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.quicklook.readonly") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any (subpath "/Library/Dictionaries") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(literal "/") +(subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")))))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (extension "com.apple.Pasteboard-readonly") + (literal-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Pasteboard/"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))) + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/printd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.app-sandbox.read") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID"))))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (extension "com.apple.revisiond.staging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging"))) + (require-all + (extension "com.apple.revisiond.revision") + (require-any + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (subpath "/private/var/.DocumentRevisions-V100/PerUID")))))) +(allow file-test-existence) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Mobile Documents"))))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2") +(iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2")) + (iokit-user-client-class "IOHIDEventServiceFastPathUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOHIDLibUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.contactsd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.pasteboard.pasted")) + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace") +(global-name "com.apple.UIKit.KeyboardManagement.hosted")) + (b4 0017 a080 2ce3) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (34 aae0 a080 2d0b) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.FileProvider") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (b4 0018 a080 2cef) + (global-name "com.apple.cache_delete.public") + (require-any (global-name "com.apple.VoiceOverTouch.drag.xpc") +(global-name "com.apple.assistivetouchd.drag.xpc") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.audio.AudioComponentPrefs") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.DragUI.druid.destination") +(global-name "com.apple.DragUI.druid.source") +(global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.progressd") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (34 a381 a080 8d4c) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.marco") + (global-name "com.apple.accessories.externalaccessory-server") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.sharingd") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.backboard.display.services") + (34 aaa8 a080 2cff) + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.lsd.mapdb") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (34 aadc a080 2cfe) + (global-name "com.apple.securityd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.assertiond.processinfoservice") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird.token") + (global-name "com.apple.nanoprefsync") + (34 aad7 a080 2d17) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.frontboard.systemappservices") + (34 ab2e a080 2d13) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.calaccessd") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (extension "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow network-outbound + (literal "/private/var/run/printd") + (literal "/private/var/run/syslog")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.camera") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.preferences.sounds") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.InputModePreferences") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.homesharing") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.airplay") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coreanimation") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.da") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.quicklook.quicklookd") + (preference-domain "com.apple.mediaaccessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.medialibrary") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.VoiceOverTouch") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.lookup.shared") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.assistant.backedup") + (require-any (preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.SpeakSelection") +(preference-domain "com.apple.voiceservices")) + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.logging") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.quicklook.quicklookd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/quicklookd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb new file mode 100644 index 0000000..3053309 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb @@ -0,0 +1,118 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/private/etc/master.passwd") + (literal "/dev/sha1_0") + (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") + (subpath "/private/var/run/racoon") + (literal "/dev/aes_0") + (subpath "/private/etc/racoon") + (literal "/dev/dtracehelper")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (subpath "/private/etc/racoon") + (literal "/dev/sha1_0") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/db/icu") + (subpath "/private/var/run/racoon") + (subpath "/usr/share") + (literal "/dev/aes_0") + (literal "/Library/Preferences") + (subpath "/private/var/Managed Preferences/mobile") + (require-any (literal "/private/var/run/racoon.sock") +(literal "/private/var/log/racoon.log")) + (require-any (subpath "/private/var/preferences") +(literal "/Library/Managed Preferences/mobile")) + (require-any (literal "/Library/Managed Preferences") +(subpath "/private/var/root")) + (literal "/private/var/run/racoon.pid") + (literal "/private/etc/master.passwd") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/sbin") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (require-any (literal "/etc") +(literal "/tmp") +(literal "/private/etc/localtime") +(literal "/var"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal "/private/var/run/racoon.sock") +(literal "/private/var/log/racoon.log")) + (literal "/private/var/run/racoon.pid") + (require-all + (file-mode #o0000) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.logger") + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.nehelper") + (34 a381 a080 43e3) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.trustd") + (global-name "com.apple.ocspd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.diagnosticd")) +(allow network* + (local udp "*:500") + (local udp "*:4500") + (remote udp "*:*") + (literal "/private/var/run/racoon.sock")) +(allow network-outbound + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input") + (control-name "com.apple.net.ipsec_control")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb.xml new file mode 100644 index 0000000..06a645a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/racoon.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb new file mode 100644 index 0000000..53e2d04 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb @@ -0,0 +1,696 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/usr/libexec") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle/Application") + (subpath-prefix "${HOME}/Library/ReplayKit") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/ReplayKit") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.pegasus") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (require-any (global-name "com.apple.audio.reporting.xpc") +(global-name "com.apple.audio.AudioQueueServer")) + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.coremedia.virtualdisplaysession") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.audio.AudioComponentRegistrar") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.coremedia.admin") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (remote tcp "*:443") + (remote tcp "*:80")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.replayd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.replayd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/replayd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb new file mode 100644 index 0000000..27cb51c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb @@ -0,0 +1,368 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.webinspector") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.reversetemplated") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.AppSupport") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.reversetemplated")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/reversetemplated.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb new file mode 100644 index 0000000..9ba3168 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb @@ -0,0 +1,491 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (literal "/dev/fsevents")) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (require-any (extension-class "com.apple.revisiond.revision") +(extension-class "com.apple.revisiond.staging")) + (require-any + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-not (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist")) + (literal "/dev/fsevents") + (require-not (literal "/dev/ptmx")) + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (subpath "/private/var/preferences/Logging") + (require-not (literal "/dev/dtracehelper")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all (require-not (literal "/dev/zero")) +(require-not (literal "/dev/null"))) + (require-not (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-not (literal "/dev/aes_0")) + (extension "com.apple.sandbox.executable") + (require-all (require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo")) +(require-not (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo"))) + (require-all (require-not (subpath "/private/var/db/datadetectors/sys")) +(require-not (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library"))) + (subpath "/System/Library") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/Developer") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")) + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")) + (require-not (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (require-not (extension "com.apple.sandbox.pty"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-all (require-not (regex #"/dev/ttyp[a-f0-9]")) +(require-not (regex #"/dev/ptyp[a-f0-9]")))) + (require-all + (uid 0) + (require-not (literal "/private/etc/master.passwd"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/log/com.apple.revisiond") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.revisiond") + (global-name "com.apple.symptom_diagnostics") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 2a6b) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb.xml new file mode 100644 index 0000000..98518bf --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/revisiond.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb new file mode 100644 index 0000000..3041e9e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb @@ -0,0 +1,811 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-journal") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-shm") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-wal") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_coreduetd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_duetexpertd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_routined") +(literal-prefix "${HOME}/Library/") +(literal "/usr/libexec/routined")) + (subpath "/private/var/db/timezone") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.routined") +(literal-prefix "${HOME}/Library/Logs/coreduetd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") +(literal-prefix "${HOME}/Library/Logs/duetexpertd_") +(literal-prefix "${HOME}/Library/Logs/routined_") +(literal-prefix "${HOME}/Library/Logs/") +(literal "/private/var/Managed Preferences/mobile/com.apple.routined.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (subpath "/Library/Audio/Plug-Ins") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/usr/share") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.routined") +(literal-prefix "${HOME}/Library/Logs/coreduetd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") +(literal-prefix "${HOME}/Library/Logs/duetexpertd_") +(literal-prefix "${HOME}/Library/Logs/routined_") +(literal-prefix "${HOME}/Library/Logs/") +(literal "/private/var/Managed Preferences/mobile/com.apple.routined.plist")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name "CDPM/com.apple.routined")) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.contactsd") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.system.logger") + (global-name "com.apple.GSSCred") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.awdd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.CallHistorySyncHelper") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.lsd.xpc") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.locationd.routine") +(global-name "com.apple.navigationListener") +(global-name "com.apple.passd.usage")) + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.carkit.service") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.calaccessd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.Maps.mapspushd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (require-any (preference-domain "com.apple.coreduet.perfmetrics") +(preference-domain "com.apple.routined")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.coreduet.perfmetrics") +(preference-domain "com.apple.routined"))) +(allow process-exec* + (literal "/usr/bin/ditto")) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb.xml new file mode 100644 index 0000000..4fa9541 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/routined.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb new file mode 100644 index 0000000..b4e147b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb @@ -0,0 +1,475 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/Keychains") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath "/private/var/Keychains") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleCredentialManagerUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.security.swcagent") +(global-name "com.apple.security.cloudkeychainproxy3") +(global-name "com.apple.security.keychainsyncingoveridsproxy")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.cloudd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/securityd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb new file mode 100644 index 0000000..41537cf --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb @@ -0,0 +1,690 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (require-any (subpath "/System/Library/StockholmPlugins") +(literal "/usr/libexec/seld")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.seld") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.seld") +(literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.seld") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.seld") +(literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "AppleSSEUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.nfcd") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.securityd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 8e67) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow mach-register + (global-name "com.apple.seld.aps") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.logging") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.passbook") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.seld") + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.stockholm.awd") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.seld") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/seld.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb new file mode 100644 index 0000000..f93befd --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb @@ -0,0 +1,1210 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (subpath "/System/Library") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sharing.airdrop.readonly")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal "/usr/libexec") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/Sharing") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Media/Recordings") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (subpath "/AppleInternal/Applications/Sharing.app") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath "/usr/lib") + (literal "/private/var") + (extension "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (literal "/private") + (subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/PhotoData") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-sharingd.log") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.sharingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.sharingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}") + (require-any + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Downloads") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media/Memories") + (vnode-type SYMLINK) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")))) + (require-all + (vnode-type SYMLINK) + (require-any + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision")) + (require-all + (subpath "/private/var/.DocumentRevisions-V100/PerUID") + (extension "com.apple.revisiond.revision"))))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Sharing") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Notes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Media/Recordings") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-sharingd.log") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.sharingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.sharingd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Downloads") + (literal-prefix "${HOME}/Library/Mobile Documents") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-flags + (literal-prefix "${HOME}/Downloads")) +(allow file-write-mode + (literal-prefix "${HOME}/Downloads") + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (literal-prefix "${HOME}/Downloads") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "RootDomainUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coreduetd.knowledgebase") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.bird") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "com.apple.librariand") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.voicememod.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.studentd") + (global-name "com.apple.securityd") + (global-name "com.apple.contactsd") + (34 a381 a080 7007) + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.NPKCompanionAgent.library") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.FileProvider") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreservices.appleid.authentication") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.passd.library") + (global-name "com.apple.analyticsd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.MobileInternetSharing") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.bird.token") + (global-name "com.apple.nanoprefsync") + (34 aadc a080 25e8) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.coreduetd.context") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.passd.assertions") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.coremedia.decompressionsession") + (global-name "com.apple.calaccessd") + (global-name "com.apple.awdd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private") + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd"))) +(allow network-inbound + (local tcp "*:*") + (local udp "*:*")) +(allow network-outbound + (remote tcp "*:*") + (remote udp "*:*") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/mDNSResponder")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobilenotes") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (require-any (preference-domain "com.apple.eventkit") +(preference-domain "com.apple.coreduet.logging")) + (preference-domain "com.apple.Security") + (preference-domain "com.apple.sharingd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.mmcs") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.wirelessproxd.debug") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.sharingd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb.xml new file mode 100644 index 0000000..8635cc4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/sharingd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb new file mode 100644 index 0000000..0c04c0b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb @@ -0,0 +1,934 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (subpath-prefix "${HOME}/Library/Cookies"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library"))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Library/Social") +(subpath-prefix "${HOME}/Library/Twitter") +(subpath-prefix "${HOME}/Library/Weibo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath-prefix "${HOME}/Media/Purchases") +(subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (require-any (subpath "/Library/Ringtones") +(literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (subpath "/usr/lib") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (extension "com.apple.app-sandbox.read") + (subpath "/usr/share") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$")))) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc"))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only")))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (process-attribute 4) + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath-prefix "${HOME}/Library/Social") +(subpath-prefix "${HOME}/Library/Twitter") +(subpath-prefix "${HOME}/Library/Weibo")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.FileCoordination") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.pegasus") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.trustd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.contactsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (global-name "com.apple.accountsd.oauthsigner") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (34 aadc a080 2462) + (global-name "com.apple.springboard.services") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.nanoprefsync") + (34 a381 a080 2463) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.sandboxserver.xpc") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.local-name")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name-regex #".+") + (extension "com.apple.security.exception.mach-lookup.global-name")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.twitterd") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.springboard") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (require-any (preference-domain "com.apple.weibo.xpc") +(preference-domain "com.apple.vimeo.xpc") +(preference-domain "com.apple.twitter.xpc") +(preference-domain "com.apple.tencentweibo.xpc") +(preference-domain "com.apple.flickr.xpc") +(preference-domain "com.apple.facebook.xpc")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.CFNetwork") + (preference-domain "com.apple.accountsd") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.weibo.xpc") +(preference-domain "com.apple.vimeo.xpc") +(preference-domain "com.apple.twitter.xpc") +(preference-domain "com.apple.tencentweibo.xpc") +(preference-domain "com.apple.flickr.xpc") +(preference-domain "com.apple.facebook.xpc")) + (preference-domain "com.apple.twitterd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/social-services.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb new file mode 100644 index 0000000..9769e6e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb @@ -0,0 +1,335 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") +(subpath "/private/var/MobileSoftwareUpdate") +(subpath "/private/var/db/UpdateMetrics")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.assets.read") + (require-any + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/MobileAsset"))) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/.overprovisioning_file") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/MobileSoftwareUpdate") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") +(subpath "/private/var/MobileSoftwareUpdate") +(subpath "/private/var/db/UpdateMetrics")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/OTAUpdate-") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/MobileSoftwareUpdate") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient")) +(allow iokit-set-properties + (iokit-property "IONVRAM-DELETE-PROPERTY")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.MobileSoftwareUpdate") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.MobileAsset") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/softwareupdated.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb new file mode 100644 index 0000000..6a239da --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb @@ -0,0 +1,500 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal "/usr/libexec/streaming_zip_conduit") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow file-write-data + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY)))) +(allow file-write-unlink + (require-all + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Media")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY)))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mobile.installd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/streaming_zip_conduit.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb new file mode 100644 index 0000000..e17556c --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb @@ -0,0 +1,613 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Classroom.app") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/WebClips") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/studentd") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.studentd")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/studentd") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.studentd")) + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.contactsd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.logind.client.machService") +(global-name "com.apple.sharing.classroom-transfer")) + (global-name "com.apple.iokit.powerdxpc") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.GSSCred") + (global-name "com.apple.coremedia.figcpecryptor") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.securityd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.pegasus") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.logd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (34 a381 a080 9a2b) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow"))) +(allow network-outbound + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.PeoplePicker") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.studentd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (preference-domain "com.apple.storeservices.itfe") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.security")))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.studentd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/studentd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb new file mode 100644 index 0000000..d3288e8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb @@ -0,0 +1,693 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/db/timezone") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Suggestions") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/ResponseKit") + (subpath-prefix "${HOME}/Library/Mail") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.CoreSuggestions.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/personalization_" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]personalization_" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?personalization_" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?personalization_" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?personalization_") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-xattr + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter")) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Calendar") + (subpath-prefix "${HOME}/Library/ResponseKit") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Suggestions") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (require-all + (require-not (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/personalization_" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]personalization_" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/([.])?personalization_" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/([.])?personalization_" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/([.])?personalization_")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.analyticsd") + (global-name "com.apple.contactsd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.logd.events") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ibooks.BLService") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.appstored.xpc.updates") + (global-name "com.apple.securityd") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.logd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.trustd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 2157) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.syncdefaultsd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.reversetemplated") + (global-name "com.apple.calaccessd") + (global-name "com.apple.routined.registration") + (global-name "com.apple.awdd") + (require-entitlement "com.apple.appstored.install-apps") + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.CrashReporter") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.demo-settings") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.PeoplePicker") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.DataMigration") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.message") + (preference-domain "com.apple.spotlightui") + (require-any (preference-domain "com.apple.CoreSuggestions") +(preference-domain "com.apple.suggestd")) + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (require-any (preference-domain "com.apple.CoreSuggestions") +(preference-domain "com.apple.suggestd")) + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/suggestd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb new file mode 100644 index 0000000..9826184 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb @@ -0,0 +1,514 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/db/timezone") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Preferences") + (literal "/dev/ptmx") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/Managed Preferences/mobile") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Library/SyncedPreferences") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.syncdefaultsd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.syncdefaultsd")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Caches") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (literal "/private/etc/hosts") + (require-not (literal-prefix "${HOME}/Library/")) + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/SyncedPreferences") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.syncdefaultsd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.syncdefaultsd")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/Managed Preferences/mobile") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (literal "/private/var/run/lockdown.sock")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.WebFoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb.xml new file mode 100644 index 0000000..18bd525 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syncdefaultsd.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb new file mode 100644 index 0000000..d4691d4 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb @@ -0,0 +1,336 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/uuidtext") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (literal "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type REGULAR-FILE) + (file-mode #o0001)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow mach-priv-task-port) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb.xml new file mode 100644 index 0000000..68ca6b1 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/syslog_relay.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb new file mode 100644 index 0000000..15c1984 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb @@ -0,0 +1,23 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/test-common.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb new file mode 100644 index 0000000..f6ffb1b --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb @@ -0,0 +1,606 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.testmanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.testmanagerd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.testmanagerd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.testmanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.testmanagerd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AGXCommandQueue") + (iokit-user-client-class "AGXDevice") + (iokit-user-client-class "AGXSharedUserClient")) +(allow iokit-get-properties + (iokit-property "emu") + (require-all + (iokit-user-client-class "IOPlatformDevice") + (iokit-property "product-id")) + (require-all + (iokit-user-client-class "IOAcceleratorES") + (require-any (iokit-property "BaseAddressAlignmentRequirement") +(iokit-property "IOGLES") +(iokit-property "MetalPluginClassName") +(iokit-property "MetalPluginName"))) + (require-all + (iokit-user-client-class "IOMobileFramebuffer") + (iokit-property "hdcp-hoover-protocol"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.logd.events") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.securityd") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.logd") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.ReportCrash.SimulateCrash") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.instruments.deviceservice.xpc") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram-get + (nvram-variable "emu")) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.testmanagerd") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.testmanagerd")) +(allow process-exec* + (literal "/usr/bin/sample")) +(allow process-fork) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow signal) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb.xml new file mode 100644 index 0000000..599c58a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/testmanagerd.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb new file mode 100644 index 0000000..cd8a39a --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb @@ -0,0 +1,286 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-read* + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/AddressBook") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Media/Vibrations") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/ptmx") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Media") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal "/private/var") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/Vibrations") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-allow")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Media/Vibrations") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb.xml new file mode 100644 index 0000000..3120105 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/tonelibraryd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb new file mode 100644 index 0000000..89c1f01 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb @@ -0,0 +1,62 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/share") + (subpath "/private/var/db/dyld")))) +(allow file-read-metadata + (require-any (literal "/etc") +(literal "/tmp") +(literal "/private/etc/localtime") +(literal "/var"))) +(allow file-test-existence) +(allow file-write* + (require-all + (file-mode #o0000) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (34 a381 a080 183b) + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.logd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.system.logger")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow socket-ioctl) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb.xml new file mode 100644 index 0000000..550ca15 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trace.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb new file mode 100644 index 0000000..185e85d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb @@ -0,0 +1,101 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow file-write* + (require-any (subpath "/private/var/spool/mdt") +(subpath-prefix "${HOME}/Library/Application Support/Containers") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.mdt") +(subpath-prefix "${HOME}/Library/Inboxes")) + (literal-prefix "${HOME}/Library/Application Support") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Downloads")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/transitd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb new file mode 100644 index 0000000..8b4e33e --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb @@ -0,0 +1,201 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.mobileassetd") +(global-name "com.apple.mobileassetd.v2")) + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.trustdFileHelper") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/trustd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb new file mode 100644 index 0000000..75c7287 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb @@ -0,0 +1,488 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (subpath "/private/var/personalized_automation/AppleInternal/Library") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/usr/local/etc/scripter") +(literal "/private/var/personalized_automation/usr/libexec") +(literal "/private/var/personalized_prod_automation/usr/libexec")) + (literal "/usr/libexec") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath "/private/var/personalized_automation/AppleInternal/Library") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/share") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath-prefix "${HOME}/Library/Logs/CrashReporter/UIALogs") +(subpath-prefix "${HOME}/Media/uiautomation") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.uiautomation")) + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/CrashReporter/UIALogs") +(subpath-prefix "${HOME}/Media/uiautomation") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.uiautomation")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceSendRight") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleJPEGDriverUserClient") + (iokit-user-client-class "IOSurfaceAcceleratorClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AGXDevice")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.UIAutomation") +(preference-domain "com.apple.Carousel")) + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.purplebuddy") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.UIAutomation") +(preference-domain "com.apple.Carousel")) + (preference-domain "com.apple.Sharing")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/uiautomationd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb new file mode 100644 index 0000000..e8a876f --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb @@ -0,0 +1,426 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]"))) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfs_helper.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb new file mode 100644 index 0000000..58d1942 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb @@ -0,0 +1,551 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-ioctl + (ioctl-command (_IO "d" 22)) + (ioctl-command (_IO "d" 24)) + (ioctl-command (_IO "d" 25))) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath "/System/Library") + (extension "com.apple.sandbox.executable"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Caches") + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.filesystems.userfs_helper") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-any (literal "/System/Library/Filesystems/exfat.fs/Contents/Resources/fsck_exfat") +(literal "/System/Library/Filesystems/msdos.fs/Contents/Resources/fsck_msdos"))) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb.xml new file mode 100644 index 0000000..51b8ed8 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/userfsd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb new file mode 100644 index 0000000..79d20ec --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb @@ -0,0 +1,279 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/dev/ptmx") + (literal "/dev/dtracehelper") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Application Support/videosubscriptionsd") + (extension "com.apple.app-sandbox.read-write") + (subpath "/private/var/db/timezone") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Application Support/com.apple.spotlight/subscriptions.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Application Support/videosubscriptionsd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/videosubscriptionsd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb new file mode 100644 index 0000000..fac0b3d --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb @@ -0,0 +1,459 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")))))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (subpath "/System/Library") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (subpath-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-not (subpath "/private/var/logs")) + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/mobile/Library$" #"^/private/var/euser[0-9]+/Library/" #"^/private/var/euser[0-9]+/Library$" #"^/private/var/[-0-9A-F]+/Library/" #"^/private/var/[-0-9A-F]+/Library$" #"^/private/var/Users/[^/]+/Library/" #"^/private/var/Users/[^/]+/Library$")) + (require-not (subpath "/private/var/tmp")) + (require-not (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-not (regex #"^/private/var/mobile/Containers/" #"^/private/var/mobile/Containers$" #"^/private/var/euser[0-9]+/Containers/" #"^/private/var/euser[0-9]+/Containers$" #"^/private/var/[-0-9A-F]+/Containers/" #"^/private/var/[-0-9A-F]+/Containers$" #"^/private/var/Users/[^/]+/Containers/" #"^/private/var/Users/[^/]+/Containers$")) + (require-not (subpath "/private/var/containers"))) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$")))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow ipc-posix-sem*) +(allow ipc-posix-sem-create) +(allow ipc-posix-sem-open) +(allow ipc-posix-sem-post) +(allow ipc-posix-sem-unlink) +(allow ipc-posix-sem-wait) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.f5.f5_sslvpn_plugin") + (require-all + (local-name-regex #".+") + (extension "com.apple.security.exception.mach-register.local-name")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (socket-domain 39) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb.xml new file mode 100644 index 0000000..d550490 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/vpn-plugins.sb.xml @@ -0,0 +1,60 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb new file mode 100644 index 0000000..cb17ba5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb @@ -0,0 +1,760 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.nsurlsessiond.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.container") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (require-any + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.wcd.readonly") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$")) + (require-all + (extension-class "com.apple.foundation.upload-prep.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$")))))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.sharing.airdrop.readonly") + (extension-class "com.apple.mediaserverd.read") + (extension-class "com.apple.wcd.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))) + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly")))))))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/com.apple.itunesstored") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.watchlistd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.watchlistd")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.watchlistd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.watchlistd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchlistd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.watchlistd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.watchlistd")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.watchlistd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.watchlistd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Caches"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (subpath-prefix "${FRONT_USER_HOME}") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.networkd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.lsd.installation") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.VideoSubscriberAccount.videosubscriptionsd") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.GSSCred") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9a2b) + (global-name "com.apple.logd.events") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-entitlement "com.apple.coreduetd.allow") + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CFNetwork") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb.xml new file mode 100644 index 0000000..4cbdac3 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/watchlistd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb new file mode 100644 index 0000000..b4827c5 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb @@ -0,0 +1,951 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-issue-extension + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (require-any + (extension-class "com.apple.app-sandbox.read") + (require-all + (debug-mode) + (extension-class "com.apple.nsurlsessiond.readonly")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (extension "com.apple.wcd.readonly") + (require-any + (subpath "/private/var/containers/Bundle") + (subpath "/Applications") + (subpath "/Developer/Applications") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$"))))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-all + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (require-entitlement "com.apple.security.system-groups" + (require-any + (require-all + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.nsurlsessiond.readonly") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.sharing.airdrop.readonly"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (require-any + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$"))) +(allow file-link) +(allow file-read* + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath "/usr/libexec") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/WatchConnectivity/Clients") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.sandbox.executable") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (subpath "/private/var/db/timezone") + (literal "/dev/ptmx") + (subpath "/Developer") + (subpath "/usr/lib") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (debug-mode) + (require-any + (require-any (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") +(literal "/private/var/preferences/com.apple.networkd.plist")) + (subpath "/usr/local/lib") + (subpath "/AppleInternal") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") + (literal "/private/var/Managed Preferences/mobile/com.apple.SystemConfiguration.plist"))) + (require-all + (extension "com.apple.wcd.readonly") + (require-any + (subpath "/private/var/containers/Bundle") + (subpath "/Applications") + (subpath "/Developer/Applications") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$"))))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ClockKit[.]activeComplications$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.](ClockKi|sockpuppe)t[.]activeComplications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.](ClockKi|sockpuppe)t[.]activeComplications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.](ClockKi|sockpuppe)t[.]activeComplications$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/WatchConnectivity") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/DeviceRegistry") + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$")))) + (require-all + (debug-mode) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/WatchConnectivity") + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-test-existence) +(allow file-write* + (subpath-prefix "${HOME}/Library/WatchConnectivity/Clients") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$"))))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/WatchConnectivity") + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (require-any + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.hangtracerd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.pegasus") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.volumecontroller.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") +(global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.routingcontext.xpc") +(global-name "com.apple.coremedia.routediscoverer.xpc") +(global-name "com.apple.coremedia.recorder")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.coremedia.sandboxserver.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.locationd.synchronous") + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.customurlloader.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.fig.movie") +(global-name "com.apple.coremedia.player.xpc")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.logd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 193e) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.apsd") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.formatreader.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (global-name "com.apple.analyticsd") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (debug-mode) + (require-any + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.GSSCred") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.nehelper") + (global-name "com.apple.networkd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.cookied") +(global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.symptomsd") +(global-name "com.apple.symptoms.symptomsd.managed_events")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.nesessionmanager") + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))))) + (require-all + (global-name "com.apple.Honeybee.event-notify") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow network-outbound + (debug-mode) + (require-all + (debug-mode) + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.hangtracer") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.wcd") + (preference-domain "com.apple.demo-settings") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.storeservices.itfe") + (preference-domain "com.apple.avfoundation") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.coreduet.complications.pushLimits") + (require-any (preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.nanoprefsyncd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.pairedsyncd") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.CFNetwork") + (debug-mode))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow user-preference-write + (preference-domain "com.apple.coreduet.complications.pushLimits") + (preference-domain "com.apple.wcd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (sysctl-name "kern.proc.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.argmax") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.osvariant_status") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (require-any (sysctl-name "kern.memorystatus_level") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model")) + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname"))) + (require-all + (debug-mode) + (require-any + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname") +(sysctl-name "net.statistics")) + (sysctl-name "vm.footprint_suspend") + (sysctl-name "net.routetable."))) + (require-all + (sysctl-name "kern.procargs2.") + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "kern.proc.pid.") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wcd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb new file mode 100644 index 0000000..c9f6691 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb @@ -0,0 +1,369 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/dev/dtracehelper") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/usr/libexec") + (subpath "/usr/share") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/containers/Bundle") + (literal "/dev/ptmx") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal "/private/var/preferences/com.apple.security.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Applications") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-any (subpath "/AppleInternal/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/personalized_automation/Applications") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (debug-mode) + (require-any + (subpath "/AppleInternal") + (subpath "/usr/local/lib") + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (extension "com.apple.app-sandbox.read") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-test-existence) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "PurpleSystemEventPort") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.trustd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.securityd") + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.coreduetd.people") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (global-name "com.apple.system.logger") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.logd") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 9eea) + (global-name "com.apple.tccd") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent") + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.corecaptured") + (require-entitlement "com.apple.corecapture.manager-access")) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.hangtracer") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.webinspectord") +(preference-domain "com.apple.WebInspector")) + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (preference-domain "com.apple.storeservices.itfe") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.security") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (preference-domain "com.apple.proactive.PersonalizationPortrait") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow managed-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.managed-preference.read-only")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/webinspectord.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb new file mode 100644 index 0000000..2cbc8a6 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb @@ -0,0 +1,358 @@ +(version 1) +(deny default) +(allow dynamic-code-generation) +(allow file-link) +(allow file-read* + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (require-any (subpath "/private/var/db/datadetectors/sys") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library")) + (literal "/dev/aes_0") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (literal "/dev/ptmx") + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-any (subpath "/usr/share/zoneinfo.default") +(subpath "/usr/share/firmware/wifi") +(literal "/usr/libexec/wifiFirmwareLoader") +(literal "/usr/libexec/wifiFirmwareLoaderLegacy") +(literal "/private/var/Managed Preferences/mobile/com.apple.wifiFirmwareLoader.plist") +(literal "/private/var/root/Library/Preferences/com.apple.wifiFirmwareLoader.plist")) + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/Developer") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/usr/libexec") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/zero") +(literal "/dev/null")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (subpath "/AppleInternal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-all + (subpath "/private/var/db/diagnostics") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-entitlement "com.apple.security.system-groups" + (require-any + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Caches/PassKit/cache.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationSetAsideDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath "/private/var/db/timesync") +(subpath "/private/var/userdata/diagnostics")) + (extension "com.apple.logd.read-only") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-test-existence) +(allow file-write* + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-all + (regex #"^/private/var/containers/Data/System/[^/]+/[.]com[.]apple[.]") + (regex #"^/private/var/containers/Data/System/[^/]+/")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (require-entitlement "com.apple.itunesstored.private") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (require-entitlement "com.apple.private.contactsui")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/zero") +(literal "/dev/null"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-open + (iokit-user-client-class "AppleBCMWLANUserClient")) +(allow iokit-set-properties + (iokit-property "PlatformConfig")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.ReportCrash.SimulateCrash") + (global-name "com.apple.hangtracerd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.aggregated") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc") +(global-name "com.apple.lsd.icons")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.logger") + (global-name "com.apple.coreduetd.people") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (extension "com.apple.pluginkit.plugin-service") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.logd.events") + (global-name "com.apple.containermanagerd") + (require-any (global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.xpcd") +(global-name "com.apple.dyld.closured")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.corecaptured") + (global-name "com.apple.logd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.suggestd.PersonalizationPortrait.DeletionTracking") + (require-any (global-name "com.apple.lsd.open") +(global-name "com.apple.lsd") +(global-name "com.apple.duetknowledged.activity")) + (34 a381 a080 184b) + (global-name "com.apple.tccd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent")) + (global-name "com.apple.lsd.mapdb") + (require-entitlement "com.apple.coreduetd.allow") + (require-entitlement "com.apple.itunesstored.private" + (require-any + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.appstored.xpc.updates"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.rtcreportingd")) + (require-all + (require-any (global-name "com.apple.absd") +(global-name "com.apple.absinthed")) + (require-entitlement "absinthe-client")) + (require-all + (global-name "com.apple.contactsd.launch-services-proxy") + (require-entitlement "com.apple.private.contactsui")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.nfcd.service.corenfc") + (require-entitlement "com.apple.developer.nfc.readersession.formats")) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager") + (require-entitlement "com.apple.telephonyutilities.callservicesd")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.pearld") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ibooks.BLService") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (process-attribute 4) + (require-any + (global-name "com.apple.analyticsd") + (global-name "com.apple.Honeybee.event-notify"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.dprivacyd") + (require-entitlement "com.apple.private.dprivacyd.allow")) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow socket-ioctl) +(allow system-privilege) diff --git a/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb.xml b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb.xml new file mode 100644 index 0000000..9847b08 --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/rev_profiles/wifiFirmwareLoader.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone6__2_11.0.0_15A372/references/sandbox_bundle b/tests/iPhone6__2_11.0.0_15A372/references/sandbox_bundle new file mode 100644 index 0000000..ce8c39d Binary files /dev/null and b/tests/iPhone6__2_11.0.0_15A372/references/sandbox_bundle differ diff --git a/tests/iPhone6__2_11.0.0_15A372/references/sandbox_profiles.txt b/tests/iPhone6__2_11.0.0_15A372/references/sandbox_profiles.txt new file mode 100644 index 0000000..99763bc --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/sandbox_profiles.txt @@ -0,0 +1,171 @@ +AGXCompilerService +AdSheet +AirTraffic +AnnotationKit.MigratorService +BTServer +BlueTool +CFNetworkAgent +CPLDiagnose +CVMServer +CacheDeleteAppContainerCaches +CommCenter +DataActivation +EscrowSecurityAlert +IDSCredentialsAgent +IDSRemoteURLConnectionAgent +IMDPersistenceAgent +IMRemoteURLConnectionAgent +IMTranscoderAgent +ImageDecoder +MTLCompilerService +MailCompositionService +MobileBackup +MobileSlideShow +PasteBoard +Safari.History +SafariBookmarksSyncAgent +SafariCloudHistoryPushAgent +SafariSafeBrowsing +ScreenSharingServer +ScreenshotService +StreamingUnzipService +VideoSubscriberAccountDeveloperService +VideoSubscriberAccountPrivacyService +WebSheet +accessoryd +accountsd +adtrackingd +afcd +analyticsd +appaudiod +appconduitd +apsd +assertiond +assetsd +barcode_notification +barcode_parser +bulletindistributord +closured +cloudphotod +com.apple.AssetCacheLocatorService +com.apple.GSSCred +com.apple.WebKit.Databases +com.apple.WebKit.Networking +com.apple.WebKit.WebContent +com.apple.assistant.assistantd +com.apple.bird +com.apple.captiveagent +com.apple.cloudd +com.apple.datadetectors.AddToRecentsService +com.apple.homed +com.apple.nehelper +com.apple.nesessionmanager +com.apple.networkserviceproxy +com.apple.quicklook.QLThumbnailsService +com.apple.rtcreportingd +com.apple.sandboxd +com.apple.siri.ClientFlow.ClientScripter +com.apple.snhelper +com.apple.tccd +com.apple.tzlinkd +com.apple.wirelessproxd +contactsd +container +containermanagerd +coresymbolicationd +cplogd +ctkd +dataaccessd +datadetectors +debugserver +deleted +devicecheckd +distnoted +duetexpertd +eapolclient +fileproviderd +findmydeviced +fmfd +ftp-proxy-embedded +gamed +geocorrectiond +geod +gizmoappd +gputoolsd +healthcloudd +healthd +honeybeed +iWorkXPC +iapd +identityservicesd +installd +iomfb_bics +itunesstored +kbd +keyboard +limitadtrackingd +lockdownd +logd +lsuseractivityd +mDNSResponder +mediaanalysisd +mediaserverd +message-filter +mobile-house-arrest +mobile_storage_mounter +mobile_storage_proxy +mobileactivationd +mobileassetd +nanomapscd +navd +network-filter +nfcd +nlcd +nointernet +nsurlsessiond +nsurlstoraged +online-auth-agent +parsecd +passd +personad +pfd +photoanalysisd +pkd +playground-devtools +powerlogd +printd +progressd +ptpd +quicklook-preview +quicklook-thumbnail +quicklookd +racoon +replayd +reversetemplated +revisiond +routined +securityd +seld +sharingd +social-services +softwareupdated +streaming_zip_conduit +studentd +suggestd +syncdefaultsd +syslog_relay +test-common +testmanagerd +tonelibraryd +transitd +trustd +uiautomationd +userfs_helper +userfsd +videosubscriptionsd +vpn-plugins +watchlistd +wcd +webinspectord +wifiFirmwareLoader +trace diff --git a/tests/iPhone6__2_11.0.0_15A372/references/sb_ops b/tests/iPhone6__2_11.0.0_15A372/references/sb_ops new file mode 100644 index 0000000..b4a9acb --- /dev/null +++ b/tests/iPhone6__2_11.0.0_15A372/references/sb_ops @@ -0,0 +1,143 @@ +default +appleevent-send +authorization-right-obtain +boot-arg-set +device* +device-camera +device-microphone +distributed-notification-post +dynamic-code-generation +file* +file-chroot +file-ioctl +file-issue-extension +file-link +file-map-executable +file-mknod +file-mount +file-mount-update +file-read* +file-read-data +file-read-metadata +file-read-xattr +file-revoke +file-search +file-test-existence +file-unmount +file-write* +file-write-acl +file-write-create +file-write-data +file-write-finderinfo +file-write-flags +file-write-mode +file-write-owner +file-write-setugid +file-write-times +file-write-unlink +file-write-xattr +fs-rename +fs-snapshot* +fs-snapshot-create +fs-snapshot-delete +fs-snapshot-revert +generic-issue-extension +qtn-user +hid-control +iokit* +iokit-issue-extension +iokit-open +iokit-set-properties +iokit-get-properties +ipc* +ipc-posix* +ipc-posix-issue-extension +ipc-posix-sem* +ipc-posix-sem-create +ipc-posix-sem-open +ipc-posix-sem-post +ipc-posix-sem-unlink +ipc-posix-sem-wait +ipc-posix-shm* +ipc-posix-shm-read* +ipc-posix-shm-read-data +ipc-posix-shm-read-metadata +ipc-posix-shm-write* +ipc-posix-shm-write-create +ipc-posix-shm-write-data +ipc-posix-shm-write-unlink +ipc-sysv* +ipc-sysv-msg +ipc-sysv-sem +ipc-sysv-shm +job-creation +load-unsigned-code +lsopen +mach* +mach-cross-domain-lookup +mach-host* +mach-host-exception-port-set +mach-host-special-port-set +mach-issue-extension +mach-lookup +mach-per-user-lookup +mach-priv* +mach-priv-host-port +mach-priv-task-port +mach-register +mach-task-name +network* +network-inbound +network-bind +network-outbound +nvram* +nvram-delete +nvram-get +nvram-set +user-preference* +user-preference-read +managed-preference-read +user-preference-write +process* +process-codesigning-status* +process-codesigning-status-set +process-codesigning-status-get +process-exec* +process-exec-interpreter +process-fork +process-info* +process-info-codesignature +process-info-dirtycontrol +process-info-listpids +process-info-rusage +process-info-pidinfo +process-info-pidfdinfo +process-info-pidfileportinfo +process-info-setcontrol +pseudo-tty +signal +socket-ioctl +sysctl* +sysctl-read +sysctl-write +system* +system-acct +system-audit +system-chud +system-debug +system-fsctl +system-info +system-kext* +system-kext-load +system-kext-unload +system-kext-query +system-mac-label +system-nfssvc +system-package-check +system-privilege +system-reboot +system-sched +system-set-time +system-socket +system-suspend-resume +system-swap diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/inputs/sandbox.kext b/tests/iPhone_4.0_64bit_10.3.3_14G60/inputs/sandbox.kext new file mode 100644 index 0000000..eb1b420 Binary files /dev/null and b/tests/iPhone_4.0_64bit_10.3.3_14G60/inputs/sandbox.kext differ diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/logs/.dummy b/tests/iPhone_4.0_64bit_10.3.3_14G60/logs/.dummy new file mode 100644 index 0000000..e69de29 diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb new file mode 100644 index 0000000..74d4e19 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb @@ -0,0 +1,546 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library/Extensions") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/OpenGL") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-"))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow mach-task-name + (target self)) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl* + (extension "com.apple.security.exception.sysctl.read-write")) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes")))) +(allow system-privilege) +(allow system-sched + (require-entitlement "com.apple.private.kernel.override-cpumon")) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AGXCompilerService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb new file mode 100644 index 0000000..7e058e1 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb @@ -0,0 +1,1609 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.mediaserverd.read") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension-class "com.apple.app-sandbox.read") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone"))) +(allow file-link + (require-all + (require-not (subpath-prefix "${HOME}/Library/AddressBook")) + (require-any + (require-not (subpath-prefix "${HOME}/Media")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))))) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/SMS") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") +(literal-prefix "${HOME}/Library/Cookies") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone") +(literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPad.settings") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPhone.settings")) + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.AdSheetPad.plist") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.AdSheetPhone.plist")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/dtracehelper") + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.AdSheetPhone-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.AdSheetPad-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Mobile Documents") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal "/private/var/run/syslog") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-shm") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-journal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb-wal") +(literal-prefix "${HOME}/Library/Cookies/com.apple.iAd.cookiedb") +(literal-prefix "${HOME}/Library/Cookies") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/URLCache") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.LocationPermissions") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iad.adlibd")) + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/SMS") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPad") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AdSheetPhone")) + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPhone") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/network-constraints.plist") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPad") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.AdSheetPhone") +(literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPad.settings") +(subpath-prefix "${HOME}/Documents/com.apple.AdSheetPhone.settings")) + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPad")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AdSheetPhone")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Cookies")) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/Caches/com.apple.iTunesStore/ISURLBag"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPad.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.AdSheetPhone.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.cache_delete") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.chatkit.clientcomposeserver.xpc") +(global-name "com.apple.companion.camera") +(global-name "com.apple.coremedia.cameraviewfinder") +(global-name "com.apple.iad.") +(global-name "com.apple.imagent.Embedded.Launched") +(global-name "com.apple.mobile.deleted")) + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.dataaccess.dataaccessd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemAppPort") + (global-name "com.apple.assistant.analytics") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.accountsd.oauthsigner") + (require-any (global-name "com.apple.passd.assertions") +(global-name "com.apple.passd.library") +(global-name "com.apple.NPKCompanionAgent.library")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "PurplePPTServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.UIKit.statusbarserver") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.ait.client") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.networkd") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.CARenderServer") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.mediaremoted.xpc") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.imagent.embedded.auth") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.calaccessd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.sharingd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.dataaccess.dataaccessd.active") +(global-name "com.apple.passd.in-app-payment")) + (global-name "com.apple.twitterd.server") + (global-name "com.apple.assistant.settings") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.webinspector") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.nehelper") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.eventpump") +(global-name "com.apple.mobilemail.messageuiservices")) + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.mobilemail") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.fig.movie") + (global-name "PurpleSystemEventPort") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.bird") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd") +(global-name "com.apple.WebBookmarks.webbookmarksd")) + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.pegasus") + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (local-name "com.apple.assistant.contextprovider.") + (local-name "com.apple.iphone.axserver") + (local-name "com.apple.accessibility.gax.client") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/printd") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.da") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.coreaudio") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.AdSheetPad") +(preference-domain "com.apple.AdSheetPhone") +(preference-domain "com.apple.reminders")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.itunesstored") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.Preferences") + (require-any (preference-domain "com.apple.AdSheetPad") +(preference-domain "com.apple.AdSheetPhone") +(preference-domain "com.apple.reminders")) + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (require-not (sysctl-name "sysctl.proc_native")) + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.statistics") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-fsctl + (fsctl-command (_IO "h" 31)) + (fsctl-command (_IO "h" 32))) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AdSheet.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb new file mode 100644 index 0000000..13ab0c1 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb @@ -0,0 +1,723 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal "/private/etc/master.passwd")) + (require-not (literal "/private/var")) + (require-not (literal "/private/var/root")) + (require-any + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (regex #"^/private/var/mobile/" #"^/private/var/mobile$" #"^/private/var/euser[0-9]+/" #"^/private/var/euser[0-9]+$" #"^/private/var/[-0-9A-F]+/" #"^/private/var/[-0-9A-F]+$" #"^/private/var/Users/[^/]+/" #"^/private/var/Users/[^/]+$") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (vnode-type CHARACTER-DEVICE) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal "/private/etc/master.passwd")) + (require-not (literal "/private/var")) + (require-not (literal "/private/var/root")) + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.atc") + (regex #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/mobile/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/euser[0-9]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/[-0-9A-F]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache/" #"^/private/var/Users/[^/]+/Library/Caches/sharedCaches/com[.]apple[.]iTunesStore[.]NSURLCache$") + (regex #"^/private/var/mobile/" #"^/private/var/mobile$" #"^/private/var/euser[0-9]+/" #"^/private/var/euser[0-9]+$" #"^/private/var/[-0-9A-F]+/" #"^/private/var/[-0-9A-F]+$" #"^/private/var/Users/[^/]+/" #"^/private/var/Users/[^/]+$") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.atc"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cache_delete") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.fig.movie") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.adid") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.modifydb") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.mobile.installd") + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.pairedsyncd.progress") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.voicememod.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.backupd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:443") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.statistics") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-fsctl + (fsctl-command (_IO "h" 27)) + (fsctl-command (_IO "h" 28)) + (fsctl-command (_IO "h" 29))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AirTraffic.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb new file mode 100644 index 0000000..3cffae2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb @@ -0,0 +1,306 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "hw.machine") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/AnnotationKit.MigratorService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb new file mode 100644 index 0000000..f7e917a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb @@ -0,0 +1,808 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/uart.log") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (literal "/dev/dtracehelper")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Library/AddressBook"))) +(allow file-read* + (subpath "/Developer") + (literal "/dev/uart.log") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/private/var/wireless/Library/Logs/awd") + (subpath "/Library/Application Support/BTServer") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.logd.read-only") + (require-any (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") +(literal "/private/var/wireless/Library/CallHistory/call_history.db") +(literal "/private/var/wireless/Library/CallHistory") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db") +(literal "/Library/Application Support/BTServer") +(literal "/") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/BTServer-") +(subpath-prefix "${HOME}/Library/Logs/Bluetooth") +(subpath-prefix "${HOME}/Library/MobileBluetooth")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (subpath "/System") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/dev/btwake") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/usr/sbin") + (literal "/usr/sbin/BTServer")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/usr/sbin/BTServer") + (require-any (literal "/private/var/wireless") +(literal "/private/var/wireless/Library")) + (literal "/private/var") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/usr/sbin") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/Library/Preferences") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-read-xattr + (subpath-prefix "${HOME}/Library/Logs/CrashReporter")) +(allow file-write* + (require-any (literal "/private/var/wireless/Library/CallHistory/call_history.db-wal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-journal") +(literal "/private/var/wireless/Library/CallHistory/call_history.db-shm") +(literal "/private/var/wireless/Library/CallHistory/call_history.db") +(literal "/private/var/wireless/Library/CallHistory") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-journal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-shm") +(literal "/Library/Application Support/BTServer/pincode_defaults.db-wal") +(literal "/Library/Application Support/BTServer/pincode_defaults.db") +(literal "/Library/Application Support/BTServer") +(literal "/") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/BTServer-") +(subpath-prefix "${HOME}/Library/Logs/Bluetooth") +(subpath-prefix "${HOME}/Library/MobileBluetooth")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/wireless/Library/Logs/awd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/hci") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (literal "/Library/Application Support/BTServer")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/wireless/Library/CallHistory"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write-data + (literal "/dev/uart.log") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOUserEthernetResourceUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "shm_pcm_audio_sco_write") +(ipc-posix-name "shm_pcm_audio_sco_read")) + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name-regex #"^..:..:..:..:..:..-tacl$") + (require-any (ipc-posix-name "com.apple.BTServer.magnet.shm") +(ipc-posix-name "shm_notif.tacl.R") +(ipc-posix-name "shm_notif.tacl.W") +(ipc-posix-name "shm_notif.tsco.W") +(ipc-posix-name "shm_notif.tsco.R"))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.carkit.service") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.BlueTool") +(global-name "com.apple.BTAudioHALPlugin.xpc") +(global-name "com.apple.BTServer.avrcp") +(global-name "com.apple.BTServer.map") +(global-name "com.apple.BTServer.pbap")) + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.suggestd.contacts") +(global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.lsd.modifydb") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.networkd") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.BTServer.airplane") +(preference-domain "com.apple.BTServer") +(preference-domain "com.apple.CoreBluetooth.cloud") +(preference-domain "com.apple.MobileBluetooth.debug") +(preference-domain "com.apple.MobileBluetooth.devices") +(preference-domain "com.apple.MobileBluetooth.ledevices") +(preference-domain "com.apple.MobileBluetooth.services")) + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.icloud.findmydeviced") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.BTServer.airplane") +(preference-domain "com.apple.BTServer") +(preference-domain "com.apple.CoreBluetooth.cloud") +(preference-domain "com.apple.MobileBluetooth.debug") +(preference-domain "com.apple.MobileBluetooth.devices") +(preference-domain "com.apple.MobileBluetooth.ledevices") +(preference-domain "com.apple.MobileBluetooth.services"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.wakereason") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.statistics") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb.xml new file mode 100644 index 0000000..1b2c185 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BTServer.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb new file mode 100644 index 0000000..b321bc2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb @@ -0,0 +1,546 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/private/etc/bluetool") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/AppleInternal") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (literal "/usr/sbin") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (literal "/dev/btreset") + (literal "/dev/btwake")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/dev/bt$" #"^/dev/bt.+$") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleBasebandUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.statistics") + (sysctl-name "kern.hostname") + (extension "com.apple.security.exception.sysctl.read-write") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/BlueTool.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb new file mode 100644 index 0000000..8b83698 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb @@ -0,0 +1,163 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CFNetworkAgent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb new file mode 100644 index 0000000..3e2d8d0 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb @@ -0,0 +1,683 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Media")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-read* + (debug-mode) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CPL-diagnostics")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/Logs") +(subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL") +(subpath-prefix "${FRONT_USER_HOME}/Media/PhotoData/Caches") +(subpath-prefix "${FRONT_USER_HOME}/Library/com.apple.nsurlsessiond") +(subpath "/private/var/logs/CrashReporter")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/diagnostics") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (subpath "/private/var/db/uuidtext") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/Photos.sqlite-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-journal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-shm") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage/store.cloudphotodb-wal") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage") +(literal-prefix "${FRONT_USER_HOME}/Media/PhotoData") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CPL-diagnostics")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Media/PhotoData/CPL/storage"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.logd.admin") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SystemConfiguration.configd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.cloudphotod") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.photoanalysisd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow mach-priv-task-port + (debug-mode)) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow process-exec* + (debug-mode)) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (sysctl-name "kern.proc.") + (debug-mode)) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CPLDiagnose.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb new file mode 100644 index 0000000..357cec2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb @@ -0,0 +1,294 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (extension "com.apple.logd.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/System/Library/Frameworks/OpenGLES.framework") +(subpath "/usr/bin/codesign_allocate")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.cvmsCompAgent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-any (subpath "/System/Library/Frameworks/OpenGLES.framework") +(subpath "/usr/bin/codesign_allocate"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CVMServer.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb new file mode 100644 index 0000000..7cc6c29 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb @@ -0,0 +1,328 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/usr/lib") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Containers/Bundle/Application") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/tmp") + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/tmp/com.apple.LaunchServices.Placeholders") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/tmp") + (subpath "/private/var/tmp/com.apple.LaunchServices.Placeholders") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath "/private/var/containers/Bundle/Application") + (subpath-prefix "${HOME}/Containers/Bundle/Application") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coreduetd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.modifydb") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CacheDeleteAppContainerCaches.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb new file mode 100644 index 0000000..debb274 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb @@ -0,0 +1,514 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/dtracehelper") + (require-any (literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log") +(literal "/dev/uart.umts") +(literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/cu.debug")) + (literal "/dev/ptmx") + (literal "/dev/uart.log") + (subpath "/private/var/wireless") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (require-any (subpath "/private/var/wireless/Library/Caches/com.apple.CommCenter") +(subpath "/private/var/wireless/Library/Caches/com.apple.coretelephony") +(subpath "/private/var/wireless/Library/Caches/CommCenterClassic")) + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (literal "/usr/local/lib/CarrierBundleDevKey.dylib") + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable")) +(allow file-read* + (subpath "/Developer") + (literal "/private/etc/hosts") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.coretelephony") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.coretelephony") +(subpath-prefix "${FRONT_USER_HOME}/Library/LASD") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/private/var/tmp/CSI.scratch") +(literal "/private/var/preferences/AeneasCustomFlags.plist")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/uart.log") + (require-not (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log") +(literal "/dev/uart.umts") +(literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/cu.debug")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal "/dev") +(literal-prefix "${FRONT_USER_HOME}/Library/SyncedPreferences/com.apple.coretelephony.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.persistentconnection.plist")) + (subpath "/private/var/logs/WirelessLibraryLogs") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/[-0-9A-F]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/Users/[^/]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/[-0-9A-F]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/Users/[^/]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile$" #"^/private/var/mobile/Library$" #"^/private/var/mobile/Library/CallHistory$" #"^/private/var/mobile/Library/Carrier Bundle.bundle$" #"^/private/var/mobile/Library/Operator Bundle.bundle$" #"^/private/var/mobile/Library/Voicemail$" #"^/private/var/mobile/Library/Preferences$" #"^/private/var/euser[0-9]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$" #"^/private/var/[-0-9A-F]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$" #"^/private/var/Users/[^/]+((((((/Library)?|/Library/CallHistory)|/Library/Carrier Bundle.bundle)|/Library/Operator Bundle.bundle)|/Library/Voicemail)|/Library/Preferences)$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (literal "/dev/dlci.spi-baseband.") +(literal "/dev/bbcdc.") +(literal "/dev/mux.spi-baseband") +(literal "/dev/mux.log") +(literal "/dev/uart.umts") +(literal "/dev/uart.debug") +(literal "/dev/uart.debug.log") +(literal "/dev/cu.debug")) + (subpath "/private/var/logs/WirelessLibraryLogs") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/uart.log") + (require-any (literal "/private/var/CommCenter/spool/loading") +(literal "/private/var/logs/CoreTelephonyTraceScratch") +(literal "/private/var/logs/log-bb-live-stats.txt") +(literal "/private/var/preferences/SystemConfiguration/preferences.plist-lock") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist-lock") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist-new") +(literal "/private/var/preferences/SystemConfiguration/OSThermalStatus.plist") +(literal "/private/var/preferences/csidata.tmp") +(literal "/private/var/preferences/csidata")) + (regex #"^/private/var/logs/CoreTelephonyTrace$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-$" #"^/private/var/logs/CoreTelephonyTrace/log-bb-.+$") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.coretelephony") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.coretelephony") +(subpath-prefix "${FRONT_USER_HOME}/Library/LASD") +(literal-prefix "${FRONT_USER_HOME}") +(literal "/private/var/tmp/CSI.scratch") +(literal "/private/var/preferences/AeneasCustomFlags.plist")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/wireless") + (regex #"^/private/var/logs/CrashReporter/Baseband/log-bb-$" #"^/private/var/logs/CrashReporter/Baseband/log-bb-.+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/CallHistory/call_history[.]db$" #"^/private/var/mobile/Library/Voicemail/voicemail[.]db$" #"^/private/var/euser[0-9]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/[-0-9A-F]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$" #"^/private/var/Users/[^/]+/Library/(CallHistory/call_history|Voicemail/voicemail)[.]db$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/PersistentConnection/CommCenter" #"^/private/var/mobile/Library/Logs/CrashReporter/PersistentConnection/CommCenter" #"^/private/var/euser[0-9]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/[-0-9A-F]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter" #"^/private/var/Users/[^/]+/Library/Logs/(CrashReporter/)?PersistentConnection/CommCenter") + (subpath-prefix "${FRONT_USER_HOME}"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.commcenter.plist")) +(allow file-write-unlink + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.apple.CommCenter.lasd") + (global-name-regex #"^com[.]apple[.]CoreTelephony[.]LogChannel[.]$" #"^com[.]apple[.]CoreTelephony[.]LogChannel[.][-0-9A-F]+$") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iqagent") + (require-any (preference-domain "com.apple.videoconference_override") +(preference-domain "com.apple.cellulardataplan") +(preference-domain "com.apple.commcenter") +(preference-domain "com.apple.tethering_override")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.apsalerts") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.operator") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.link.generic.ifdata") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "sysctl.proc_native") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.statistics") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 1))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb.xml new file mode 100644 index 0000000..bd4ad12 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/CommCenter.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb new file mode 100644 index 0000000..d27b886 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb @@ -0,0 +1,974 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/WebClips") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-read* + (subpath "/Developer") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.DataActivation.settings")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (subpath-prefix "${HOME}/Media/DCIM") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (require-any (subpath-prefix "${HOME}/Library/Caches/Safari") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") +(subpath-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Preferences/.dat") +(literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.DataActivation.plist") +(subpath "/Applications/DataActivation.app") +(subpath "/Applications/MobileSafari.app") +(subpath "/AppleInternal/Library/Safari")) + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (extension "com.apple.logd.read-only") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/private/var/db/timezone") + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension "com.apple.app-sandbox.read") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilemail.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.OTASyncAgent.plist"))) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.DataActivation-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (require-any (subpath-prefix "${HOME}/Library/Caches/Safari") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp-") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.webapp") +(subpath-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Preferences/.dat") +(literal-prefix "${HOME}/Media/com.apple.itdbprep.postprocess.lock")) + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.DataActivation-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.DataActivation.settings")) + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Library/Caches/com.apple.DataActivation") + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Mail/AutoFetchEnabled")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-deny")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.DataActivation")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.DataActivation.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/asl_input") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/printd") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.keyboard") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.DataActivation") +(preference-domain "com.apple.youtube.dp")) + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.aggregated") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.da") + (preference-domain "com.apple.corevideo") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.telephonyutilities.dialassist") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.mobilesafari") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.DataActivation") +(preference-domain "com.apple.youtube.dp")) + (preference-domain "com.apple.mobilesafari") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework")) +(allow process-exec* + (require-any (literal "/Applications/MobileSafari.app/MobileSafari") +(literal "/Applications/DataActivation.app/DataActivation"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb.xml new file mode 100644 index 0000000..8f5f4e2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/DataActivation.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb new file mode 100644 index 0000000..84cc200 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb @@ -0,0 +1,297 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudServices") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/EscrowSecurityAlert.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb new file mode 100644 index 0000000..d4d0f44 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb @@ -0,0 +1,217 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.ids.IDSCredentialsAgent") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.ids.IDSCredentialsAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSCredentialsAgent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..0c26abe --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb @@ -0,0 +1,541 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (literal "/private/var") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent") + (preference-domain "com.apple.conference") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.idsfoundation.IDSRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IDSRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb new file mode 100644 index 0000000..71cc190 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb @@ -0,0 +1,387 @@ +(version 1) +(deny default) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/AddressBook") + (subpath-prefix "${HOME}/Library/SMS") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Media") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath-prefix "${HOME}/Library/Logs/SMSMigrator") +(subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS")) + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/SMSMigrator") +(subpath-prefix "${HOME}/Library/Caches/com.apple.MobileSMS")) + (subpath-prefix "${HOME}/Library/AddressBook") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/SMS") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.search.appindexer") +(global-name "com.apple.searchd") +(global-name "com.apple.suggestd.messages")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.imdsmsrecordstore") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.message") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.imdpersistence.IMDPersistenceAgent") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.imdpersistence.IMDPersistenceAgent") + (preference-domain "com.apple.imdsmsrecordstore")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMDPersistenceAgent.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb new file mode 100644 index 0000000..4d21e0d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb @@ -0,0 +1,545 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}") +(literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.imfoundation.IMRemoteURLConnectionAgent") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/IMRemoteURLConnectionAgent") +(literal-prefix "${FRONT_USER_HOME}") +(literal-prefix "${HOME}/Library/Logs/awd/awd-IMRemoteURLConnectionAgent.log")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imfoundation.IMRemoteURLConnectionAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.awdd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.conference") + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.imfoundation.IMRemoteURLConnectionAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMRemoteURLConnectionAgent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb new file mode 100644 index 0000000..7ec8c6d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb @@ -0,0 +1,788 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (extension "com.apple.im.transcode") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.avatar") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.avatar") + (subpath-prefix "${HOME}/Library/SMS/Attachments") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.im.transcode") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.imtranscoding.IMTranscoderAgent") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.imtranscoding.IMTranscoderAgent")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.marco") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.ET") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.MobileSMS") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.imtranscoding.IMTranscoderAgent")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/IMTranscoderAgent.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb new file mode 100644 index 0000000..939af6f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb @@ -0,0 +1,214 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library/Extensions") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs/Metal") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MTLCompilerService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb new file mode 100644 index 0000000..55c87e2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb @@ -0,0 +1,1299 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy")))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.app-sandbox.read-write") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (extension "com.apple.logd.read-only") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath-prefix "${HOME}/Library/ConfigurationProfiles") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/AppleInternal/Library/Frameworks") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.app-sandbox.read") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.MailCompositionService.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.MailCompositionService.settings")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${HOME}/Library/WebClips") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/ptmx") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.MailCompositionService-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.MailCompositionService") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.MailCompositionService-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.MailCompositionService.settings")) + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MailCompositionService")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.MailCompositionService.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd") +(global-name "com.apple.WebBookmarks.webbookmarksd")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.springboard") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coreduetd") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.audio.AudioQueueServer") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemAppPort") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilemail.services.xpc") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.mediastream.sharing") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "PurplePPTServer") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (require-any (global-name "com.apple.suggestd.contacts") +(global-name "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.bulletinboard.utilitiesconnection") +(global-name "com.apple.suggestd.suggestionmanager") +(global-name "com.apple.dataaccess.dataaccessd")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.mediaserverd") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.networkd") + (global-name "com.apple.sharingd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.assistant.settings") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.webinspector") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.bird") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.nehelper") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.trustd") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.pegasus") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.da") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ZoomTouch") + (preference-domain "com.apple.EmojiPreferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.MailCompositionService") + (preference-domain "com.apple.message") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.WebKit") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coreaudio") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.MailCompositionService") + (preference-domain "com.apple.mail.composition") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.Preferences")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MailCompositionService.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb new file mode 100644 index 0000000..5d50517 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb @@ -0,0 +1,9 @@ +(version 1) +(allow default) +(deny file-read* + (subpath "/private/var/run/mobile_image_mounter")) +(deny file-write-unlink + (literal "/private") + (literal "/private/var") + (literal "/private/var/run")) +(deny job-creation) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb.xml new file mode 100644 index 0000000..c2485d3 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileBackup.sb.xml @@ -0,0 +1,21 @@ + + + + + + + + + +]> + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb new file mode 100644 index 0000000..d7a33b7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb @@ -0,0 +1,1268 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath "/private/var/MobileAsset/Assets")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/private/var/MobileAsset/Assets")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/MediaAnalysis"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.camera")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (literal-prefix "${HOME}/Library/SpringBoard")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes/iTunes Library.itlp") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/SMS") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (literal-prefix "${HOME}/Library/Logs/awd") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") +(subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") +(subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") +(subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") +(subpath-prefix "${HOME}/Library/Siri")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") +(subpath-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]" #"^/private/var/[-0-9A-F]+/Media/Pano_[0-9]" #"^/private/var/Users/[^/]+/Media/Pano_[0-9]") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (subpath-prefix "${HOME}/Media/Memories") + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (require-any (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.mobileslideshow.plist") +(literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.camera.plist")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.camera") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow-") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.mobileslideshow.settings") +(subpath-prefix "${HOME}/Documents/com.apple.camera.settings")) + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-not (regex #"^/private/var/mobile/Library/" #"^/private/var/euser[0-9]+/Library/" #"^/private/var/[-0-9A-F]+/Library/" #"^/private/var/Users/[^/]+/Library/")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.camera-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.mobileslideshow-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.camera") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/DCIM") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${HOME}/Library/Siri") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Siri")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-Camera.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-MobileSlideShow.log") +(literal-prefix "${HOME}/Library/Logs/awd/awdComponent0x19.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup") +(subpath-prefix "${HOME}/Library/Caches/com.apple.legacycamera") +(subpath-prefix "${HOME}/Library/Application Support/MobileSlideShow") +(subpath-prefix "${HOME}/Library/Application Support/iLifePageLayout") +(subpath-prefix "${HOME}/Library/Siri")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/SMS") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (require-any (literal-prefix "${HOME}/Library/SpringBoard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.springboard.sharedimagecache/Wallpaper")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (debug-mode) + (regex #"^/private/var/mobile/Media/Pano_[0-9]" #"^/private/var/euser[0-9]+/Media/Pano_[0-9]" #"^/private/var/[-0-9A-F]+/Media/Pano_[0-9]" #"^/private/var/Users/[^/]+/Media/Pano_[0-9]") + (subpath-prefix "${HOME}")) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.mobileipod.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.mobileipod.plist")) + (require-any + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photos.peopleImageCache") + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photos.peopleImageCache")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.camera") +(subpath-prefix "${HOME}/Library/Caches/com.apple.mobileslideshow")) + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (subpath-prefix "${HOME}/Library/WebClips") + (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-any (subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.mobileslideshow-") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.camera-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState/") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState/") +(subpath-prefix "${HOME}/Documents/com.apple.mobileslideshow.settings") +(subpath-prefix "${HOME}/Documents/com.apple.camera.settings")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.camera")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileslideshow")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")))))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/DiagnosticLogs/Camera-latest.log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/SpringBoard/Lock.+" #"^/private/var/mobile/Library/SpringBoard/.+Lock.+" #"^/private/var/mobile/Library/SpringBoard/Home.+" #"^/private/var/mobile/Library/SpringBoard/.+Home.+" #"^/private/var/euser[0-9]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/[-0-9A-F]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+" #"^/private/var/Users/[^/]+/Library/SpringBoard/((.*Lock|Home)|.+Home).+") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/awd") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudPhotoLibrary.aslgroup")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.camera.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.mobileslideshow.savedState")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Siri")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath "/private/var/mnt")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coremedia") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.EmojiPreferences") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.WebKit") + (require-any (preference-domain "com.apple.nanocamera") +(preference-domain "com.apple.legacycamera") +(preference-domain "com.apple.videouploadplugins") +(preference-domain "com.apple.youtubeframework.notbackedup")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.cloud.quota") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.da") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.ids") + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.MobileSMS") + (preference-domain "com.apple.ImageCaptureFramework") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.act") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.VoiceOverTouch") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.mobilemail") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.WebFoundation") + (require-any (preference-domain "com.apple.nanocamera") +(preference-domain "com.apple.legacycamera") +(preference-domain "com.apple.videouploadplugins") +(preference-domain "com.apple.youtubeframework.notbackedup")) + (preference-domain "com.apple.cloud.quota") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.Preferences") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.appleaccount")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb.xml new file mode 100644 index 0000000..a149983 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/MobileSlideShow.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb new file mode 100644 index 0000000..4e59497 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb @@ -0,0 +1,216 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard")) + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (vnode-type CHARACTER-DEVICE) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.Pasteboard") +(subpath-prefix "${HOME}/Library/Caches/com.apple.UIKit.pboard")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (literal "/System/Library/Frameworks/UIKit.framework/Support/pasteboardd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "sysctl.proc_native") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb.xml new file mode 100644 index 0000000..edf9b5e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/PasteBoard.sb.xml @@ -0,0 +1,49 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb new file mode 100644 index 0000000..29c9f92 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb @@ -0,0 +1,301 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/db/icu") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath "/System") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.Safari.SafeBrowsing") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.statistics") + (sysctl-name "kern.usrstack64") + (extension "com.apple.security.exception.sysctl.read-write") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/SafariSafeBrowsing.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb new file mode 100644 index 0000000..7c82698 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb @@ -0,0 +1,533 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal-prefix "${PROCESS_TEMP_DIR}/ScreenSharingServer.log") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${PROCESS_TEMP_DIR}/ScreenSharingServer.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.springboard.services") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.videoconference.camera") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.ScreenSharingViewServiceHelper") +(global-name "com.apple.springboard.statusbarservices")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.ids") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb.xml new file mode 100644 index 0000000..dcf0787 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenSharingServer.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb new file mode 100644 index 0000000..b1db37c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb @@ -0,0 +1,254 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ScreenshotService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb new file mode 100644 index 0000000..d0ad1e5 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb @@ -0,0 +1,229 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.StreamingUnzipService") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/db/timezone") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.StreamingUnzipService") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.StreamingUnzipService")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/StreamingUnzipService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb new file mode 100644 index 0000000..5d942b0 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb @@ -0,0 +1,213 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountDeveloperService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb new file mode 100644 index 0000000..655750a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb @@ -0,0 +1,163 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/VideoSubscriberAccountPrivacyService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb new file mode 100644 index 0000000..aa12504 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb @@ -0,0 +1,1244 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.app-sandbox.read-write") + (extension-class "com.apple.mediaserverd.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.mobilemail.plist$" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.mobilemail.plist$")) + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.OTASyncAgent.plist$" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.OTASyncAgent.plist$")) + (require-any + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (require-not (subpath "/System/Library/Carrier Bundles")) + (require-not (subpath-prefix "${HOME}/Library/Carrier Bundles")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.WebSheet.plist") + (require-any (subpath-prefix "${HOME}/Documents/com.apple.WebSheet.settings") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState/")) + (subpath "/AppleInternal/Library/Frameworks/RadarCompose.framework") + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (subpath-prefix "${HOME}/Library/WebClips") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/FairPlay") +(literal "/usr/sbin/fairplayd")) + (subpath-prefix "${HOME}/Media") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/ptmx") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (regex #"^/private/var/mobile/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/euser[0-9]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/[-0-9A-F]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist" #"^/private/var/Users/[^/]+/Library/SyncedPreferences/com.apple.WebSheet-.+[.]plist") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (require-any (literal-prefix "${HOME}/Library/Caches/Snapshots") +(literal-prefix "${HOME}/Library/Saved Application State")) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (subpath-prefix "${HOME}/Library/Cookies") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (literal-prefix "${HOME}/Library/Caches") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebAppCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-not (regex #"^/private/var/mobile/Library/Mail/AutoFetchEnabled$" #"^/private/var/euser[0-9]+/Library/Mail/AutoFetchEnabled$" #"^/private/var/[-0-9A-F]+/Library/Mail/AutoFetchEnabled$" #"^/private/var/Users/[^/]+/Library/Mail/AutoFetchEnabled$")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.WebSheet") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (subpath-prefix "${HOME}/Documents/com.apple.WebSheet.settings") +(subpath-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet") +(literal-prefix "${HOME}/Library/Caches/Snapshots/com.apple.WebSheet-") +(literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState/")) + (subpath-prefix "${HOME}/Library/WebClips") + (require-any (subpath-prefix "${HOME}/Library/WebKit/LocalStorage") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-journal") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-shm") +(literal-prefix "${HOME}/Library/WebKit/Databases/Databases.db-wal") +(literal-prefix "${HOME}/Library/WebKit/Databases")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/WebKit") +(subpath-prefix "${HOME}/Media/Safari")) + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.WebSheet")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/LocalStorage")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/WebKit/Databases"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (require-all (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.Accessibility.plist")) +(require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.UIKit.plist"))) + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Snapshots")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Saved Application State/com.apple.WebSheet.savedState"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.fig.movie") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "com.apple.mobilesafari-settings") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (global-name "com.apple.parsecd") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.librariand") + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.sharingd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.assistant.settings") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.webinspector") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilemail") + (global-name "com.apple.audio.AudioQueueServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.bird") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.certui.relay") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.eventpump") +(global-name "com.apple.mobilemail.messageuiservices")) + (global-name "com.apple.symptomsd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd") +(global-name "com.apple.WebBookmarks.webbookmarksd")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.da") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ZoomTouch") + (preference-domain "com.apple.EmojiPreferences") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.WebKit") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.WebSheet") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework")) +(allow process-exec* + (literal "/Applications/WebSheet.app/WebSheet")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/WebSheet.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb new file mode 100644 index 0000000..6860711 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb @@ -0,0 +1,550 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.afc.root") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (extension "com.apple.logd.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (literal "/usr/libexec") + (require-any (literal "/usr/libexec/afcd") +(literal "/AFCDEBUG")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (extension "com.apple.afc.root") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private") + (literal "/Library/Preferences/SystemConfiguration") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.afc") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.afc.root") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.afc")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.xpchelper") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.afc") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.maxvnodes") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/afcd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb new file mode 100644 index 0000000..3469351 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${HOME}/Library/AppConduit") +(subpath-prefix "${HOME}/Library/Logs/AirTraffic") +(subpath-prefix "${HOME}/Library/Logs/AppConduit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (subpath "/private/var/db/MobileIdentityData") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/AppConduit") +(subpath-prefix "${HOME}/Library/Logs/AirTraffic") +(subpath-prefix "${HOME}/Library/Logs/AppConduit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.AppConduit.staging")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]appconduitd[.]gizmostate" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]companionappd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]sockpuppet[.]activeComplications") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.misagent") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cache_delete") + (global-name "com.apple.atc.xpc") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.nanoprefsync") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.modifydb") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/appconduitd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb new file mode 100644 index 0000000..290ed27 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb @@ -0,0 +1,441 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath "/private/var/Managed Preferences/mobile") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (regex #"^/System/Library/CoreServices/SystemVersion$" #"^/System/Library/CoreServices/SystemVersion.+$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/Library/Managed Preferences/mobile") +(subpath "/private/var/preferences")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${HOME}/Library/Logs") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-any (subpath "/usr") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") +(subpath "/private/etc") +(literal "/private/etcLibrary/Keychains") +(literal "/private/") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicEffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}") +(subpath-prefix "${HOME}/Library/Managed Preferences")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/Keychains") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/Library/Preferences") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") +(subpath-prefix "${HOME}/Library/ApplePushService")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Preferences") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.apsd") + (subpath-prefix "${HOME}/Library/Logs") + (subpath-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection") +(subpath-prefix "${HOME}/Library/ApplePushService")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.apsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow network-inbound + (literal "/")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/ApplePushService.framework/apsd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.statistics") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "sysctl.proc_native") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb.xml new file mode 100644 index 0000000..bd4ad12 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/apsd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb new file mode 100644 index 0000000..504f9d2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb @@ -0,0 +1,328 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/usr/libexec") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (vnode-type CHARACTER-DEVICE) + (subpath "/Applications") + (extension "com.apple.sandbox.executable") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.spindump") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-task-name) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.assertiond") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.assertiond")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (require-any (sysctl-name "kern.ipc.throttle_best_effort") +(sysctl-name "kern.memorystatus_vm_pressure_send"))) +(allow sysctl-read + (sysctl-name "kern.max_task_pmem") + (require-any (sysctl-name "kern.ipc.throttle_best_effort") +(sysctl-name "kern.memorystatus_vm_pressure_send")) + (extension "com.apple.security.exception.sysctl.read-only") + (extension "com.apple.security.exception.sysctl.read-write") + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb.xml new file mode 100644 index 0000000..d261902 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/assertiond.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb new file mode 100644 index 0000000..d93ff53 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb @@ -0,0 +1,661 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-read* + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/BulletinDistributor") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices"))) +(allow file-read-data + (literal "/usr/libexec")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/BulletinDistributor") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/BulletinDistributor/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]bulletinboard[.]apps" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.pairedsyncd.progress") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.bulletinboard.observerconnection") +(global-name "com.apple.companionappd.pingsubscriber") +(global-name "com.apple.sysdiagnose.service.xpc")) + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.awdd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.fig.movie") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.nanoprefsync") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.bulletinboard.settingsconnection") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.bulletinboard") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.bulletindistributor") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.persistentconnection") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "bulletindistributord") +(preference-domain "com.apple.sysdiagnose")) + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.bulletindistributor")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/bulletindistributord.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb new file mode 100644 index 0000000..b3f00f7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb @@ -0,0 +1,20 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb.xml new file mode 100644 index 0000000..941d510 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cloudphotod.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb new file mode 100644 index 0000000..afdd5db --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb @@ -0,0 +1,527 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/SystemConfiguration/NetworkInterfaces.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssetCacheLocatorService") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssetCacheLocatorService")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.AssetCacheC") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local udp "*:*")) +(allow network-bind + (local udp "*:*")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote udp "*:53") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AssetCacheLocatorService") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AssetCacheTetherator") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.AssetCacheLocatorService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb new file mode 100644 index 0000000..1e7b60c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb @@ -0,0 +1,213 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/db/heim-credential-store.archive") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal "/private/var/db/heim-credential-store.archive") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.GSSCred.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb new file mode 100644 index 0000000..2396837 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb @@ -0,0 +1,129 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb.xml new file mode 100644 index 0000000..cac2cf8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Databases.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb new file mode 100644 index 0000000..d8427ef --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb @@ -0,0 +1,399 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath "/usr/share") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.ocspd") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote udp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb.xml new file mode 100644 index 0000000..cac2cf8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.Networking.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb new file mode 100644 index 0000000..825953d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb @@ -0,0 +1,1048 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.app-sandbox.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (extension-class "com.apple.nsurlstorage.extension-cache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (require-not (extension "com.apple.sandbox.executable")) + (subpath "/Developer") + (require-not (regex #"/[^/]+/SC_Info/" #".+/[^/]+/SC_Info/"))) +(allow file-read* + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/dev/aes_0") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.app-sandbox.read") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.app-sandbox.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-xattr + (require-all + (require-not (xattr "com.apple.security.private.")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-com.apple.WebKit.WebContent.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (vnode-type SYMLINK)) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (require-not (xattr "com.apple.security.private.")) + (require-any + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.fig.movie") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.bird") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.itunesstored.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.assertiond.expiration") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.sharingd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.webinspector") + (global-name "com.apple.nehelper") + (global-name "com.apple.librariand") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.audio.AudioQueueServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote udp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iapd") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.keyboard") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.voiceservices.logging") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.da") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.mt") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaaccessibility.public") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.mediaaccessibility.public")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.statistics") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-audit) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml new file mode 100644 index 0000000..cac2cf8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.WebKit.WebContent.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb new file mode 100644 index 0000000..58337f9 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb @@ -0,0 +1,695 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd"))) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (subpath-prefix "${HOME}/siri_recordings") +(subpath "/Library/Audio/Tunings")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (require-any (subpath-prefix "${HOME}/Library/Assistant") +(literal-prefix "${HOME}/Library/Caches/com.apple.siri.")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Info.plist" #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+.+/Info.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/local/lib") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (require-any (subpath-prefix "${HOME}/Library/Assistant") +(literal-prefix "${HOME}/Library/Caches/com.apple.siri.")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${HOME}/Library/Logs/awd/awd-assistantd.log") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.AssistantServices") +(subpath-prefix "${HOME}/Library/Caches/com.apple.assistantd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.AssistantServices")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.assistantd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.imagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.awdd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.absinthed") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.BTLEAudioController.xpc") +(global-name "com.apple.assistant_service")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.marco") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.absd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.avfoundation.avvc") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.AssistantServices") +(preference-domain "com.apple.assistant.token") +(preference-domain "com.apple.siri.backedup.encrypted") +(preference-domain "com.apple.weather")) + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.AssistantServices") +(preference-domain "com.apple.assistant.token") +(preference-domain "com.apple.siri.backedup.encrypted") +(preference-domain "com.apple.weather")) + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.assistant")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-socket + (socket-domain 39) + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.assistant.assistantd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb new file mode 100644 index 0000000..ca16964 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb @@ -0,0 +1,786 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension-class "com.apple.librarian.ubiquity-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.clouddocs.version") + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents/")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.quicklook.readonly"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.bird") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.bird") +(literal-prefix "${PROCESS_TEMP_DIR}/com.apple.bird") +(subpath-prefix "${HOME}/Library/Application Support/CloudDocs") +(literal-prefix "${HOME}/Library/Mobile Documents.") +(subpath-prefix "${HOME}/Library/Logs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") +(literal-prefix "${HOME}/Library/")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Application Support") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Caches/CloudKit") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CloudKit")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.bird") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.bird") +(literal-prefix "${PROCESS_TEMP_DIR}/com.apple.bird") +(subpath-prefix "${HOME}/Library/Application Support/CloudDocs") +(literal-prefix "${HOME}/Library/Mobile Documents.") +(subpath-prefix "${HOME}/Library/Logs/CloudDocs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CloudDocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.bird") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/com.apple.clouddocs") +(subpath-prefix "${HOME}/Library/Caches/CloudKit/tmp") +(literal-prefix "${HOME}/Library/")) + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity")) + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.bird") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.bird"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CloudKit")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.revisiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.nehelper") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.cache_delete") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ubd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.FSEvents") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.and.xpc") +(global-name "com.apple.bird.ContainerMetadataExtractor") +(global-name "com.apple.lsd.installation")) + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.ubd") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.bird") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mmcs") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.iCloudDriveApp") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.iCloudDriveApp") + (preference-domain "com.apple.bird")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30)) + (fsctl-command (_IO "h" 32)) + (fsctl-command (_IO "h" 31))) +(allow system-info + (info-type "hw.uuid")) +(allow system-package-check) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb.xml new file mode 100644 index 0000000..17402cd --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.bird.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb new file mode 100644 index 0000000..9140c5e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb @@ -0,0 +1,132 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec/captiveagent") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (literal "/usr/libexec") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.captiveagent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb new file mode 100644 index 0000000..4576b99 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb @@ -0,0 +1,679 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/[-0-9A-F]+/Library/Caches/CloudKit/[^/]+/[^/]+" #"^/private/var/Users/[^/]+/Library/Caches/CloudKit/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (regex #"^/private/var/mobile/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Library/Containers/[^/]+/Data/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit" #".+/private/var/containers/[^/]+/[^/]+/[^/]+/Library/Caches/CloudKit") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}") + (require-any + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension-class "com.apple.app-sandbox.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type CHARACTER-DEVICE) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/.TemporaryItems") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") +(subpath-prefix "${HOME}/Library/Logs/awd") +(subpath-prefix "${HOME}/Library/Logs/Ubiquity") +(subpath-prefix "${HOME}/Library/Caches/CloudKit") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.cloudd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.cloudd") +(literal "/private/var/logs/Ubiquity")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${HOME}/Library/Logs/ProtectedCloudStorage.log") +(subpath-prefix "${HOME}/Library/Logs/awd") +(subpath-prefix "${HOME}/Library/Logs/Ubiquity") +(subpath-prefix "${HOME}/Library/Caches/CloudKit") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.cloudd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.cloudd") +(literal "/private/var/logs/Ubiquity")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/.TemporaryItems") + (subpath-prefix "${HOME}/Library/Caches/com.apple.cloudd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_log" #"^/private/var/mobile/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.+log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/CFNetwork_com[.]apple[.]cloudd_.*log") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/CloudKit") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.cloudd"))) +(allow file-write-create + (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_com.apple.cloudd") + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "FNetwork.defaultStorageSession") + (ipc-posix-name "com.apple.AppleDatabaseChanged") + (ipc-posix-name-regex #"^/tmp/com[.]apple[.]csseed[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name "com.apple.AppleDatabaseChanged")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.fig.movie") + (global-name "com.apple.nehelper") + (global-name "com.apple.ocspd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.fairplayd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.datamigrator") + (global-name "com.apple.absinthed") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.SecurityServer") +(global-name "com.apple.coreservices.quarantine-resolver")) + (global-name "com.apple.fairplayd.versioned") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.absd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.AssetCacheLocatorService") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.protectedcloudstorage.protectedcloudkeysyncing") +(global-name "com.apple.windowserver.active")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.migration") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.keyboard") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mmcs") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.cloudd") + (preference-domain "com.apple.CloudKit.BehaviorOptions") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.mmcs")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.cloudd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb new file mode 100644 index 0000000..91e58bf --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb @@ -0,0 +1,276 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Bundle") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.message") + (preference-domain "com.apple.mobilephone") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.datadetectors.AddToRecentsService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb new file mode 100644 index 0000000..cd92d4f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb @@ -0,0 +1,975 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit")) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/homed_") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.Home") +(subpath-prefix "${HOME}/Library/HomeConfiguration") +(subpath-prefix "${HOME}/Library/homed")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.homed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.homed")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-homed.log") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HomeKit") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/homed_") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.Home") +(subpath-prefix "${HOME}/Library/HomeConfiguration") +(subpath-prefix "${HOME}/Library/homed")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.HomeKit") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.homed") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.homed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.homed")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.homed")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.revisiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.cloudd") + (global-name "com.apple.securityd") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.awdd") + (global-name "com.apple.wirelessproxd") + (require-any (global-name "com.apple.Honeybee.event-notify") +(global-name "com.apple.PairingManager") +(global-name "com.apple.corefollowup.agent")) + (global-name "com.apple.fairplayd.versioned") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.librariand") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.apsd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.videoconference.camera") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow network* + (local udp "*:*") + (local tcp "*:*") + (remote tcp "*:*") + (remote udp "*:*")) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.facetime.bag") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "com.apple.homed") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.VideoConference") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.homed")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.homed.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb new file mode 100644 index 0000000..4b30196 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb @@ -0,0 +1,676 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/nehelper")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (subpath "/private/var/containers/Bundle/Application") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-any (literal "/usr/bin/DumpBasebandCrash") +(subpath "/usr/local/bin") +(literal "/private/var/Managed Preferences/mobile/com.apple.networkd.sysctl.plist") +(literal "/private/var/Managed Preferences/mobile/com.apple.networkd.plist")) + (require-any (literal "/private/var/preferences/com.apple.networkd.sysctl.plist") +(literal "/private/var/preferences/com.apple.networkd.carrierbundle.plist") +(literal "/private/var/preferences/com.apple.networkd.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.network.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.networkextension.plist")) + (subpath "/usr/sbin") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (subpath "/Applications") + (require-any (literal "/private/var/preferences/com.apple.networkextension.necp.plist") +(literal "/private/var/preferences/com.apple.networkextension.control.plist") +(literal "/private/var/preferences/com.apple.networkextension.cache.plist") +(literal "/private/var/preferences/com.apple.networkextension.plist")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Cookies") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/nehelper") + (require-any (literal "/private/var/preferences/com.apple.networkd.sysctl.plist") +(literal "/private/var/preferences/com.apple.networkd.carrierbundle.plist") +(literal "/private/var/preferences/com.apple.networkd.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.network.plist") +(literal "/private/var/preferences/Logging/Subsystems/com.apple.networkextension.plist")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/private/var/preferences/com.apple.networkextension.necp.plist") +(literal "/private/var/preferences/com.apple.networkextension.control.plist") +(literal "/private/var/preferences/com.apple.networkextension.cache.plist") +(literal "/private/var/preferences/com.apple.networkextension.plist")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nehelper")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.nehelper") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.logd.admin") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd_privileged") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (global-name "com.apple.nehelper") + (global-name "com.apple.networkd_privileged") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network* + (literal "/private/var/run/racoon.sock") + (local udp "*:500") + (local udp "*:4500")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (remote udp "*:*") + (remote tcp "*:*") + (literal "/private/var/run/mDNSResponder") + (control-name "com.apple.net.ipsec_control") + (literal "/private/var/run/syslog") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-any (control-name "com.apple.flow-divert") +(control-name "com.apple.net.necp_control") +(control-name "com.apple.net.netagent") +(control-name "com.apple.net.utun_control") +(control-name "com.apple.network.advisory") +(control-name "com.apple.content-filter"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.operator") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl* + (require-any (sysctl-name "kern.ipc.io_policy.throttled") +(sysctl-name "net."))) +(allow sysctl-read + (require-any (sysctl-name "kern.ipc.io_policy.throttled") +(sysctl-name "net.")) + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb.xml new file mode 100644 index 0000000..7836567 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nehelper.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb new file mode 100644 index 0000000..848b95e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb @@ -0,0 +1,626 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.vpn-plugin") + (subpath "/private/var/containers/Bundle/VPNPlugin")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/Developer/usr/libexec") +(subpath "/private/etc/ppp") +(subpath "/private/var/containers/Bundle/VPNPlugin")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (subpath "/usr/sbin") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (subpath "/private/var/run/racoon") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/racoon.pid") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/private/var/preferences/com.apple.networkextension.necp.plist") +(literal "/private/var/preferences/com.apple.networkextension.control.plist") +(literal "/private/var/preferences/com.apple.networkextension.cache.plist") +(literal "/private/var/preferences/com.apple.networkextension.plist")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nesessionmanager")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nesessionmanager")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/nesessionmanager") + (literal "/private/var/log/ppp.log") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/run/ppp[0-9]+[.]pid$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/run/racoon") + (regex #"^/private/var/preferences/SystemConfiguration/VPN-[^/]+[.]plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nesessionmanager")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/nesessionmanager"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.UNCUserNotification") +(global-name "com.apple.neagent") +(global-name "com.apple.symptom_analytics")) + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.ocspd") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.CoreServices.coreservicesd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.networkextension") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/usr/sbin/pppd")) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow sysctl* + (sysctl-name "net.key.natt_keepalive_interval")) +(allow sysctl-read + (sysctl-name "net.key.natt_keepalive_interval") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (sysctl-name "net.key.blockacq_count") + (sysctl-name "net.statistics") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb.xml new file mode 100644 index 0000000..3ed5fb6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.nesessionmanager.sb.xml @@ -0,0 +1,44 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb new file mode 100644 index 0000000..4c70b8c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb @@ -0,0 +1,388 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal-prefix "${HOME}/Library/Logs/awd/awd-networkserviceproxy.log") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/awd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-networkserviceproxy.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.awdd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (preference-domain "networkserviceproxy") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.GEO") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "networkserviceproxy")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow sysctl*) +(allow sysctl-write) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb.xml new file mode 100644 index 0000000..dac6097 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.networkserviceproxy.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb new file mode 100644 index 0000000..c54f570 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb @@ -0,0 +1,605 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/Application Support/Quick Look") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db")) + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.quicklook.readonly") + (subpath-prefix "${HOME}/Media/Books") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Fonts") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Documents" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/Collaboration/Documents" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/(Collaboration/)?Documents") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Application Support/Quick Look") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-journal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-shm") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db-wal") +(literal-prefix "${HOME}/Library/Application Support/Quick Look/cloudthumbnails.db")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Application Support/Quick Look")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.fig.movie") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.avfoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-fsctl + (fsctl-command (_IO "h" 31))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.quicklook.QLThumbnailsService.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb new file mode 100644 index 0000000..c7c0db6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb @@ -0,0 +1,551 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/rtcreportingd_")) + (literal "/usr/libexec/rtcreportingd") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.rtcreporting.upload") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/rtcreportingd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired/rtcreportingd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/rtcreportingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-rtcreportingd.log") +(literal-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs/rtcreportingd_")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/rtcreportingd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/Retired")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (extension "com.apple.rtcreporting.upload")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.awdd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.powerlogd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "rtcreportingd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.VideoConference") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.timed") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.rtcreporting") + (preference-domain "rtcreportingd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.rtcreportingd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb new file mode 100644 index 0000000..4add1c2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb @@ -0,0 +1,68 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/dtracehelper")) +(allow file-link) +(allow file-map-executable) +(allow file-read*) +(allow file-read-data) +(allow file-read-metadata) +(allow file-read-xattr) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.sandbox.system-group") + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/mobile/Library/Logs/CrashReporter/[.]Sandbox-.+[.]ips") + (regex #"^/private/var/logs/CrashReporter/Sandbox-.+[.]ips" #"^/private/var/logs/CrashReporter/[.]Sandbox-.+[.]ips") + (require-all + (literal "/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (ipc-posix-name "apple.shm.notification_center")) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (local-name "com.apple.cfprefsd.agent")) +(allow network* + (literal-prefix "${PROCESS_TEMP_DIR}/sandbox.")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (literal "/private/var/run/asl_input"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow sysctl-read) +(allow system-info + (info-type "net.link.addr")) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb.xml new file mode 100644 index 0000000..7e675f5 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.sandboxd.sb.xml @@ -0,0 +1,43 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb new file mode 100644 index 0000000..90f62ec --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb @@ -0,0 +1,456 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/Assistant") + (subpath-prefix "${HOME}/Library/Caches/com.apple.siri.ClientFlow.ScriptCache") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.siri.ClientFlow.ScriptCache")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.webinspector") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.siri.ClientFlow.ClientScripter") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.assistant") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.siri.ClientFlow.ClientScripter")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.siri.ClientFlow.ClientScripter.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb new file mode 100644 index 0000000..5d1bc85 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb @@ -0,0 +1,171 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath "/var/mobile/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-register + (global-name "com.apple.snhelper") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.snhelper.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb new file mode 100644 index 0000000..538a3f7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb @@ -0,0 +1,501 @@ +(version 1) +(deny default) +(allow file-issue-extension + (extension-class "com.apple.tcc.") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (subpath "/Developer") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.sandbox.executable") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath "/private/var/db/timezone") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (vnode-type CHARACTER-DEVICE) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath "/private/var/tmp/com.apple.tccd") +(subpath-prefix "${HOME}/Library/TCC")) + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/awd/awd-tccd.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]tccd[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.librariand") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.awdd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.backboard.systemservices") + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb.xml new file mode 100644 index 0000000..dcf0787 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tccd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb new file mode 100644 index 0000000..a767605 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb @@ -0,0 +1,22 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-write-create + (literal "/private/var/db/timezone/localtime")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.tzlinkd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb new file mode 100644 index 0000000..8b78f42 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb @@ -0,0 +1,619 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal-prefix "${HOME}/Library/Application Support") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.ubd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.ubd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-ubd.log") +(literal-prefix "${HOME}/Library/Collections") +(literal-prefix "${HOME}/Library/Mobile Documents") +(literal-prefix "${HOME}/Library/processed-Mobile Documents.delete")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (require-any (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.ubd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Application Support/Ubiquity") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Ubiquity")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.ubd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.ubd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-ubd.log") +(literal-prefix "${HOME}/Library/Collections") +(literal-prefix "${HOME}/Library/Mobile Documents") +(literal-prefix "${HOME}/Library/processed-Mobile Documents.delete")) + (literal-prefix "${HOME}/Library/Application Support") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity[.]log" #"^/private/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.+[.]log" #"^/private/var/euser[0-9]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log" #"^/private/var/[-0-9A-F]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log" #"^/private/var/Users/[^/]+/Library/Logs/CrashReporter/DiagnosticLogs/ubiquity.*[.]log") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.ubd"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.FileCoordination") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.awdd") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.bird") + (global-name "com.apple.absinthed") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.FSEvents") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.absd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.bird") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.mmcs")) +(allow process-exec* + (literal "/System/Library/PrivateFrameworks/Ubiquity.framework/Versions/A/Support/ubd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl*) +(allow sysctl-write) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 30))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb.xml new file mode 100644 index 0000000..2a53d7b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.ubd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb new file mode 100644 index 0000000..fbf4de3 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb @@ -0,0 +1,68 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (require-any (literal "/usr") +(literal "/usr/sbin/wirelessproxd")) + (literal "/usr/sbin") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/private/var/db/dyld") + (subpath "/usr/share")))) +(allow file-read-metadata + (require-any (literal "/etc") +(literal "/tmp") +(literal "/private/etc/localtime") +(literal "/var"))) +(allow file-write* + (require-all + (require-not (file-mode #o0000)) + (literal "/cores/"))) +(allow file-write-data + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name "apple.cfprefs.")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.notification_center") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (local-name "com.apple.cfprefsd.agent")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (literal "/private/var/run/asl_input") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow sysctl-read) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb.xml new file mode 100644 index 0000000..abd16d6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/com.apple.wirelessproxd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb new file mode 100644 index 0000000..ceb977d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb @@ -0,0 +1,4172 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.usernotifications.attachments.read-only")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (extension-class "com.apple.mediaserverd.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (debug-mode) + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Caches/com.apple.navd/NavTraces") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/CallServices/Ringtones") + (extension-class "com.apple.mediaserverd.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.InCallService"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/ReplayKit") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ReplayKit.RPVideoEditorExtension"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilecal"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Playgrounds.ExecutionExtension"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-link + (require-not (subpath-prefix "${HOME}/Media")) + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/System/Library") + (subpath "/Developer") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (extension "com.apple.app-sandbox.read") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-read* + (extension "com.apple.logd.read-only") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Carrier Bundles") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.security.exception.carrier-bundle.read"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal "/private/var/mobile/Media/iTunes_Control/iTunes/iTunesPrefs")) + (require-any + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/System/Library") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]stocks[.]bridge$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal "/usr/libexec") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.webbookmarksd")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]Carousel$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") +(literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (require-any (literal-prefix "${HOME}/Library/SpringBoard/.LockBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/.HomeBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/LockBackground.cpbitmap") +(literal-prefix "${HOME}/Library/SpringBoard/HomeBackground.cpbitmap")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Media") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-not (regex #"^/private/var/mobile/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.apsalerts.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.apsalerts.plist")) + (require-any + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Artwork") +(subpath-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (require-all + (regex #"^/private/var/mobile/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/euser[0-9]+/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/[-0-9A-F]+/Library/GameKit/Data/[^/]+.gcdata$" #"^/private/var/Users/[^/]+/Library/GameKit/Data/[^/]+.gcdata$") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath "/private/var/tmp/com.apple.dt.XCTest") + (require-any + (process-name "/Applications/") + (require-entitlement "get-task-allow"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Fonts") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/com.apple.storeservices/AppPurchaseHistory.6.sqlitedb-wal")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (subpath "/Library/Application Support/Mail/Plugins") +(literal "/private/var/preferences/SystemConfiguration/com.apple.AutoWake.plist") +(literal "/System/Library/PairedSyncServices/com.apple.pairedsync.mail.plist")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mobilemail") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mobilemail")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/SpringBoard/LockBackgroundThumbnail.jpg") +(literal-prefix "${HOME}/Library/SpringBoard/LockVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/HomeBackgroundThumbnail.jpg") +(literal-prefix "${HOME}/Library/SpringBoard/HomeVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/OriginalHomeVideo.mov") +(literal-prefix "${HOME}/Library/SpringBoard/OriginalLockVideo.mov")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/SpringBoard/PushStore/Attachments") + (extension "com.apple.usernotifications.attachments.read-only")) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Media/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.restrictionspassword.plist") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (subpath-prefix "${HOME}/Library/CallServices/Ringtones") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.InCallService"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-read-metadata + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (require-not (subpath-prefix "${HOME}/Library/SMS")) + (require-not (subpath-prefix "${HOME}/Media/Recordings")) + (require-any + (vnode-type SYMLINK) + (literal "/private/var") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Library/GameKit/Data") + (literal-prefix "${HOME}/Library") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal "/private/var/run/printd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (process-attribute 4) + (require-any + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/GameKit/Data") + (literal "/private/var") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")) + (require-entitlement "com.apple.media.ringtones.read-only"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (literal-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (debug-mode) + (require-entitlement "platform-application"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Logs/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Mail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Safari") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.mobilenotes") + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.Safari.SocialHelper") + (entitlement-value "com.apple.safarifetcherd")))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/SMS") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (require-any (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (subpath-prefix "${HOME}/Library/Caches/sharedCaches/com.apple.iTunesStore.NSURLCache") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/mobile/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/euser[0-9]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/[-0-9A-F]+/Library/Preferences/com.apple.restrictionspassword.plist" #"^/private/var/Users/[^/]+/Library/Preferences/com.apple.restrictionspassword.plist") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Notes") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (subpath-prefix "${HOME}/Media/Books") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMail/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMail|PairedSyncServiceRestrictions)/") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]NanoMail") + (subpath-prefix "${HOME}") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/WebClips") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webapp")))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Logs/com.apple.StoreServices") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (subpath-prefix "${HOME}/Library/Calendar") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/iTunes_Control/iTunes") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/GeoJSON") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (subpath-prefix "${HOME}/Library/Cookies") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.notes.objectcreation.lock") +(literal-prefix "${HOME}/Library/Caches/com.apple.notes.sharedstore.lock")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (subpath-prefix "${HOME}/Library/DataAccess") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mobilemail") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mobilemail")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (extension "com.apple.app-sandbox.read-write") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))))) + (require-all + (literal-prefix "${HOME}/Library/Cookies/com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-entitlement "com.apple.media.ringtones.read-write")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.storeservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.ios.StoreKitUIService"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilemail") + (entitlement-value "com.apple.mobilenotes")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Library/com.apple.iTunesStore") +(literal-prefix "${HOME}/Library/com.apple.iTunesStore/LocalStorage")) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/sharedCaches") + (require-entitlement "com.apple.itunesstored.private")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.AOSNotification.launchd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (subpath-prefix "${HOME}/Media/Purchases") + (extension "com.apple.tcc.kTCCServiceMediaLibrary") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2")))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow generic-issue-extension + (require-all + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari") + (require-any (extension-class "com.apple.webkit.camera") +(extension-class "com.apple.webkit.microphone"))))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (iokit-user-client-class "IOHIDLibUserClient") + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (extension "com.apple.security.exception.iokit-user-client-class") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (require-all + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "RootDomainUserClient") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "IOMobileFramebufferUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (require-entitlement "com.apple.private.amfi.can-load-cdhash"))) +(allow iokit-get-properties + (require-any (iokit-property "IOClassNameOverride") +(iokit-property "IORegistryEntryPropertyKeys")) + (require-any (iokit-property "compass-calibration") +(iokit-property "gyro-interrupt-calibration")) + (iokit-property "IOClass") + (require-entitlement "com.apple.system.diagnostics.iokit-properties") + (require-all + (iokit-property "name") + (iokit-user-client-class "IOService")) + (require-all + (iokit-property "name") + (iokit-user-client-class "IONetworkInterface")) + (require-all + (require-any (iokit-property "auto-focus") +(iokit-property "flash") +(iokit-property "front-auto-hdr") +(iokit-property "front-max-video-") +(iokit-property "front-hdr") +(iokit-property "front-hdr-on") +(iokit-property "front-flash-capability") +(iokit-property "front-burst") +(iokit-property "front-burst-image-duration") +(iokit-property "video-stills") +(iokit-property "video-cap") +(iokit-property "rear-slowmo") +(iokit-property "rear-max-video-") +(iokit-property "rear-max-slomo-video-fps-") +(iokit-property "rear-hdr") +(iokit-property "rear-hdr-on") +(iokit-property "rear-burst") +(iokit-property "rear-burst-image-duration") +(iokit-property "rear-auto-hdr") +(iokit-property "post-effects") +(iokit-property "pipelined-stillimage-capability") +(iokit-property "panorama") +(iokit-property "live-photo-capture") +(iokit-property "live-effects")) + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "root-ticket-hash") +(iokit-property "IOCPUID") +(iokit-property "device-imei") +(iokit-property "backlight-marketing-table")) + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property "AppleJPEG") + (iokit-user-client-class "AppleJPEGDriver")) + (require-all + (iokit-property "SupportAlwaysOnCompass") + (iokit-user-client-class "AppleSPUHIDDriver")) + (require-all + (iokit-property "DisplayPipeStrideRequirements") + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (require-any (iokit-property "BSD Name") +(iokit-property "InterfaceRole") +(iokit-property "IO80211Band") +(iokit-property "IO80211Channel") +(iokit-property "IO80211ChannelBandwidth") +(iokit-property "IO80211ChannelFrequency") +(iokit-property "IO80211RSNDone") +(iokit-property "IORequiredPacketFilters") +(iokit-property "IOPrimaryInterface") +(iokit-property "IONetworkRootType") +(iokit-property "IONetworkData") +(iokit-property "IOMediaHeaderLength") +(iokit-property "IOMediaAddressLength") +(iokit-property "IOMaxTransferUnit") +(iokit-property "IOLocation") +(iokit-property "IOInterfaceUnit") +(iokit-property "IOInterfaceType") +(iokit-property "IOInterfaceState") +(iokit-property "IOInterfaceNamePrefix") +(iokit-property "IOInterfaceFlags") +(iokit-property "IOInterfaceExtraFlags") +(iokit-property "IOControllerEnabled") +(iokit-property "IOBuiltin") +(iokit-property "IOActivePacketFilters") +(iokit-property "NetworkConfigurationOverrides")) + (iokit-user-client-class "IONetworkInterface")) + (require-all + (iokit-property "iommu-present") + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (iokit-property "name") + (require-entitlement "fairplay-client") + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "AGXParameterBufferMaxSize") +(iokit-property "BaseAddressAlignmentRequirement") +(iokit-property "PerformanceStatisticsAccum") +(iokit-property "IOGLES") +(iokit-property "InternalStatisticsAccm") +(iokit-property "InternalStatistics") +(iokit-property "MetalPluginName") +(iokit-property "MetalPluginClassName")) + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (iokit-property "PerformanceStatistics") + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (require-any (iokit-property "3d-imagery") +(iokit-property "3d-maps") +(iokit-property "navigation") +(iokit-property "adaptive-ui")) + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "CFBundleIdentifier") +(iokit-property "IOLinkSpeed") +(iokit-property "IOLinkStatus") +(iokit-property "IOPropertyMatch") +(iokit-property "IOMinPacketSize") +(iokit-property "IOMaxPacketSize")) + (iokit-user-client-class "IONetworkController")) + (require-all + (require-any (iokit-property "bitrate-") +(iokit-property "encoding") +(iokit-property "decoding") +(iokit-property "tnr-mode")) + (iokit-user-client-class "IOService")) + (require-all + (iokit-property "boot-manifest-hash") + (require-entitlement "fairplay-client") + (iokit-user-client-class "IOService")) + (require-all + (iokit-connection "AppleSynopsysOTGDevice") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "IOProviderClass") +(iokit-property "IOFeatures")) + (iokit-user-client-class "IONetworkController")) + (require-all + (iokit-property "name") + (iokit-user-client-class "IOService")) + (require-all + (iokit-property "Size") + (process-attribute 4) + (iokit-user-client-class "IOMedia")) + (require-all + (require-any (iokit-property "chip-id") +(iokit-property "display-rotation") +(iokit-property "display-scale") +(iokit-property "software-behavior") +(iokit-property "no-sdio-devices")) + (iokit-user-client-class "IOService")) + (require-all + (iokit-property "IOMACAddress") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access"))) + (require-all + (iokit-property "udid-version") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (iokit-property "IOSurfaceAcceleratorCapabilitiesDict") + (iokit-user-client-class "IOService")) + (require-all + (iokit-property-regex #"die-id$" #"chip-id$" #"board-id$" #".+((die|chip)|board)-id$") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (require-any (iokit-property "IOProviderClass") +(iokit-property "IOFeatures")) + (iokit-user-client-class "IONetworkInterface")) + (require-all + (require-any (iokit-property "AdapterInfo") +(iokit-property "AtCriticalLevel") +(iokit-property "Voltage") +(iokit-property "MaxCapacity") +(iokit-property "IsCharging") +(iokit-property "FullyCharged") +(iokit-property "ExternalConnected") +(iokit-property "ExternalChargeCapable") +(iokit-property "CurrentCapacity") +(iokit-property "CapacityEstimated")) + (iokit-connection "IOPMPowerSource")) + (require-all + (require-any (iokit-property "DisplayPipePlaneBaseAlignment") +(iokit-property "hdcp-hoover-protocol")) + (iokit-user-client-class "IOMobileFramebuffer")) + (require-all + (iokit-property "boot-manifest-hash") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) + (require-all + (iokit-property-regex #"serial-number" #"SerialNum" #"-snum" #".+serial-number" #".+SerialNum" #".+-snum") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (iokit-property "Protocol Characteristics") + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "idProduct") +(iokit-property "idVendor") +(iokit-property "Product Name") +(iokit-property "kUSBProductString")) + (iokit-connection "AppleSynopsysOTGDevice")) + (require-all + (iokit-property "IOClass") + (iokit-user-client-class "IONetworkController")) + (require-all + (iokit-property "PerformanceStatistics") + (iokit-user-client-class "IOAcceleratorES")) + (require-all + (require-any (iokit-property "artwork-display-gamut") +(iokit-property "artwork-device-idiom") +(iokit-property "artwork-device-subtype") +(iokit-property "artwork-scale-factor") +(iokit-property "product-id") +(iokit-property "product-description") +(iokit-property "offline-dictation") +(iokit-property "dictation") +(iokit-property "device-perf-memory-class") +(iokit-property "graphics-featureset-fallbacks") +(iokit-property "graphics-featureset-class") +(iokit-property "compatible-device-fallback")) + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "#address-cells") +(iokit-property "AAPL,phandle") +(iokit-property "unique-chip-id") +(iokit-property "uid-aes-key") +(iokit-property "system-trusted") +(iokit-property "software-bundle-version") +(iokit-property "security-domain") +(iokit-property "secure-boot") +(iokit-property "root-matching") +(iokit-property "random-seed") +(iokit-property "production-cert") +(iokit-property "board-id") +(iokit-property "bootp-response") +(iokit-property "boot-nonce") +(iokit-property "mix-n-match-prevention-status") +(iokit-property "mac-address-wifi0") +(iokit-property "mac-address-ethernet0") +(iokit-property "mac-address-bluetooth0") +(iokit-property "image4-supported") +(iokit-property "gid-aes-key") +(iokit-property "firmware-version") +(iokit-property "effective-security-mode-sep") +(iokit-property "effective-security-mode-ap") +(iokit-property "effective-production-status-sep") +(iokit-property "effective-production-status-ap") +(iokit-property "dram-vendor") +(iokit-property "dram-vendor-id") +(iokit-property "die-id") +(iokit-property "development-cert") +(iokit-property "debug-enabled") +(iokit-property "crypto-hash-method") +(iokit-property "consistent-debug-root") +(iokit-property "chip-epoch") +(iokit-property "certificate-security-mode") +(iokit-property "certificate-production-status")) + (require-entitlement "fairplay-client") + (iokit-user-client-class "IOService")) + (require-all + (iokit-property-regex #"UUID" #"-uuid" #".+UUID" #".+-uuid") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (require-any (iokit-property "model") +(iokit-property "platform-name") +(iokit-property "regulatory-model-number") +(iokit-property "region-info")) + (iokit-user-client-class "IOPlatformExpertDevice")) + (require-all + (iokit-property "ForceSupported") + (require-any (iokit-user-client-class "AppleMultitouchSPI") +(iokit-user-client-class "AppleMultitouchDevice"))) + (require-all + (iokit-property-regex #"[Cc]alibration" #".+[Cc]alibration") + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers"))) + (require-all + (require-any (iokit-property "battery-data") +(iokit-property "BatteryData") +(iokit-property "Serial")) + (require-entitlement "fairplay-client") + (iokit-connection "IOPMPowerSource")) + (require-all + (require-any (iokit-property "camera-front") +(iokit-property "camera-rear")) + (iokit-user-client-class "AppleARMIODevice")) + (require-all + (require-any (iokit-property "device_type") +(iokit-property "device-type")) + (iokit-user-client-class "IOService")) + (require-all + (iokit-property-regex #"-mac-address" #"mac-address-" #".+-mac-address" #".+mac-address-") + (require-any + (require-entitlement "com.apple.system.get-hardware-identifiers") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.wifi.manager-access"))) + (require-all + (iokit-property "soc-generation") + (process-attribute 4) + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "IOAccessoryBatteryPack") +(iokit-property "IOAccessoryDigitalID") +(iokit-property "IOAccessoryInterfaceDeviceInfo") +(iokit-property "IOAccessoryID") +(iokit-property "IOAccessoryManagerType") +(iokit-property "IODeviceMemory") +(iokit-property "controllers") +(iokit-property "config-number") +(iokit-property "CrashReporter-ID") +(iokit-property "Device Characteristics") +(iokit-property "AppleDiagnostic")) + (require-any + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")) + (require-entitlement "com.apple.system.get-hardware-identifiers")))) +(allow ipc-posix-sem* + (semaphore-owner self) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-create + (ipc-posix-name-regex #"^/mono[.][0-9]+$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^Apple MIDI in [0-9]+$" #"^Apple MIDI out [0-9]+$") + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (require-entitlement "inter-app-audio"))) +(allow ipc-posix-shm-write-unlink + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.syncdefaultsd") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.FileCoordination") + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.VoiceOverTouch") + (global-name "com.apple.dataaccess.dataaccessd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.ait.client") + (global-name "PurpleSystemAppPort") + (require-any (global-name "com.apple.iapd.xpc") +(global-name "com.apple.iap2d.xpc")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.librariand") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "com.apple.accessibility.AXBackBoardServer") + (require-any (global-name "com.apple.AdSheetPad.server") +(global-name "com.apple.AdSheetPhone.server") +(global-name "com.apple.MediaControl.daemon") +(global-name "com.apple.MobileAccessoryUpdater") +(global-name "com.apple.MobileFileIntegrity") +(global-name "com.apple.Music.MPMusicPlayerMigServer") +(global-name "com.apple.ReportCrash") +(global-name "com.apple.ReportCrash.DirectoryService") +(global-name "com.apple.ReportCrash.Jetsam") +(global-name "com.apple.ReportCrash.SafetyNet") +(global-name "com.apple.ReportCrash.StackShot") +(global-name "com.apple.VoiceOverTouch.xpc") +(global-name "com.apple.airplay.sender.xpc") +(global-name "com.apple.appleprofilepolicyd") +(global-name "com.apple.assetsd.keepDaemonAlive") +(global-name "com.apple.assetsd.messagingServer") +(global-name "com.apple.assetsd.notificationServer") +(global-name "com.apple.audio.AudioConverterServer") +(global-name "com.apple.audio.AudioFileServer") +(global-name "com.apple.audio.AudioUnitServer") +(global-name "com.apple.backboard.checkin") +(global-name "com.apple.backboard.watchdog") +(global-name "com.apple.backboard.workspaceserverconnection") +(global-name "com.apple.bypassBasebandAutoBooter.msgport") +(global-name "com.apple.callkit.callsourcehost") +(global-name "com.apple.clouddbd") +(global-name "com.apple.commcenter.dm-helper") +(global-name "com.apple.commcenter.mobile-helper") +(global-name "com.apple.coremedia.audioprocessingtap") +(global-name "com.apple.coremedia.cpe") +(global-name "com.apple.coremedia.cpe.xpc") +(global-name "com.apple.coremedia.cpeprotector") +(global-name "com.apple.coremedia.cpeprotector.xpc") +(global-name "com.apple.coremedia.decompressionsession") +(global-name "com.apple.coremedia.formatreader") +(global-name "com.apple.coremedia.videoqueue") +(global-name "com.apple.coremedia.wirelessdisplay") +(global-name "com.apple.coremedia.wirelessdisplayserver") +(global-name "com.apple.cvmsCompAgent_armv7") +(global-name "com.apple.datamigrator.dz") +(global-name "com.apple.distributed_notifications@0v3") +(global-name "com.apple.gamed.note") +(global-name "com.apple.iTunesStore.daemon.notifications.public") +(global-name "com.apple.iTunesStore.daemon.public") +(global-name "com.apple.iapauthd") +(global-name "com.apple.iapauthd.xpc") +(global-name "com.apple.imavagent.embedded.auth") +(global-name "com.apple.instruments.server.mig") +(global-name "com.apple.mDNSResponder") +(global-name "com.apple.managedconfiguration.mdmdpush-dev") +(global-name "com.apple.managedconfiguration.mdmdpush-prod") +(global-name "com.apple.managedconfiguration.mdmdservice") +(global-name "com.apple.mediastream.sharing-nowake") +(global-name "com.apple.midiserver") +(global-name "com.apple.mobile.softwareupdated") +(global-name "com.apple.mobileipod.MPMusicPlayerControllerInternal") +(global-name "com.apple.mobileipod.MPMusicPlayerMigServer") +(global-name "com.apple.mobileipod.MPMusicPlayerMigServerExists") +(global-name "com.apple.prdaily") +(global-name "com.apple.sandboxd") +(global-name "com.apple.scrod") +(global-name "com.apple.spotlight.SearchAgent") +(global-name "com.apple.springboard.UIKit.migserver") +(global-name "com.apple.springboard.alerts") +(global-name "com.apple.springboard.remotenotifications") +(global-name "com.apple.springboard.watchdogserver") +(global-name "com.apple.telephonyutilities.callservicesdaemon.voip") +(global-name "com.apple.telephonyutilities.remotelogdaemon") +(global-name "com.apple.testmanagerd") +(global-name "com.apple.videoconference.avconference") +(global-name "com.apple.vsassetd") +(global-name "com.apple.wapi.client") +(global-name "com.apple.watchconnectivity.complication") +(global-name "com.apple.weibod.server")) + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.certui.relay") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.fig.movie") + (global-name "com.apple.pegasus") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.audio.AudioSession") + (require-any (global-name "com.apple.assertiond.extension") +(global-name "com.apple.webfilterd") +(global-name "com.apple.WebBookmarks.webbookmarksd")) + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.gamecenter") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.midiserver.io") + (global-name "com.apple.cloudd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.mobilemail.services.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.gizmoappd") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.networking.captivenetworksupport") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.marco") + (global-name "com.apple.mDNSResponderHelper") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.FSEvents") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.iapd") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.mediastream.sharing") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.itdbprep.server") + (global-name "com.apple.gamed") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.assistant.analytics") + (require-any (global-name "com.apple.Music.MPMusicPlayerControllerInternal") +(global-name "com.apple.Music.MPMusicPlayerMigServerExists")) + (global-name "com.apple.system.libinfo.muser") + (global-name "PurplePPTServer") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.revisiond") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.parsecd") + (require-any (global-name "com.apple.passd.assertions") +(global-name "com.apple.passd.library") +(global-name "com.apple.NPKCompanionAgent.library")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.atc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.CoreAuthentication.daemon") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.nehelper") + (global-name "com.apple.vibrationmanagerd") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.springboard.blockableservices") + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.wcd") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.fairplayd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.bird") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.iap2d") +(global-name "com.apple.iaptransportd")) + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (local-name "com.apple.assistant.contextprovider.") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.coremedia.audiodeviceclock") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.sharingd") + (global-name "com.apple.videoconference.camera") + (require-any (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (require-any (global-name "com.apple.dataaccess.dataaccessd.active") +(global-name "com.apple.passd.in-app-payment")) + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.webinspector") + (require-any (global-name "com.apple.homed.xpc") +(global-name "com.apple.iap2d.distributednotification.server") +(global-name "com.apple.iapd.distributednotification.server") +(global-name "com.apple.iaptransportd.xpc")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.calaccessd.xpc") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.adid") + (require-entitlement "adi-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.bulletinboard.systemstateconnection") + (require-entitlement "com.apple.bulletinboard.systemstate")) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.icloud.findmydeviced") + (require-any + (require-entitlement "com.apple.aosnotification.aosnotifyd-access") + (require-entitlement "com.apple.icloud.findmydeviced.access"))) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (local-name "com.apple.iphone.axserver") + (require-entitlement "com.apple.accessibility.api")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.lskdd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.mediaserverd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.bulletinboard.settingsconnection") + (require-entitlement "com.apple.bulletinboard.settings")) + (require-all + (global-name "com.apple.locationd.spi") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.twitterd.server") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.bulletinboard.utilitiesconnection") + (require-entitlement "com.apple.bulletinboard.utilities")) + (require-all + (global-name "com.apple.mobilemail") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.Maps.SpringBoard") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.coremedia.admin") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (global-name "com.apple.nanomaps.xpc.Navigation") +(global-name "com.apple.nanomaps.xpc.Maps")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.absd") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.replayd") + (require-not (process-attribute is-plugin))) + (require-all + (global-name "com.apple.icfcallserver") + (require-entitlement "com.apple.private.icfcallserver")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.safarifetcherd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coreduetd") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.ABDatabaseDoctor") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.siri.vocabularyupdates") + (require-any + (require-entitlement "com.apple.developer.siri") + (require-entitlement "com.apple.siri.synapse"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.VideoSubscriberAccount.videosubscriptionsd") + (require-any + (require-entitlement "com.apple.developer.video-subscription-registration") + (require-entitlement "com.apple.private.subscriptionservice.all-sources.read-only") + (require-entitlement "com.apple.private.subscriptionservice.web-sources.read-write") + (require-entitlement "com.apple.smoot.subscriptionservice") + (require-entitlement "com.apple.private.subscriptionservice.internal"))) + (require-all + (global-name "com.apple.suggestd.mail") + (require-entitlement "com.apple.private.suggestions.mail")) + (require-all + (global-name "com.apple.nanomaps.xpc.GeoServices.Navigation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.absinthed") + (require-entitlement "absinthe-client" + (entitlement-value-regex #".+"))) + (require-all + (global-name "com.apple.medialibraryd.xpc") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (global-name "com.apple.suggestd.contacts") + (require-entitlement "com.apple.private.suggestions.contacts")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.accountsd.oauthsigner") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.unfreed") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.coreduetd") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (global-name "com.apple.personad.xpc") + (require-any + (require-entitlement "com.apple.private.contactsui") + (require-entitlement "com.apple.private.persona.read") + (require-entitlement "com.apple.private.persona.write"))) + (require-all + (global-name "com.apple.Maps.mapspushd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.healthd.server") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (require-any + (require-entitlement "com.apple.private.imcore.imremoteurlconnection") + (require-entitlement "com.apple.private.ids.remoteurlconnection"))) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.identityservicesd.embedded.auth") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.aps.alertprovider.xpc") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.spotlight.IndexAgent") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.backupd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.familycircle.agent") + (require-entitlement "com.apple.private.familycircle")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.cache_delete") + (require-any + (require-entitlement "com.apple.mobile.deleted.AllowFreeSpace") + (require-entitlement "com.apple.private.CacheDelete"))) + (require-all + (global-name "com.apple.fig.movie") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (global-name "com.apple.mobile.keybagd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.advisory_socket"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.accountsd.accountmanager") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.assistant.analytics") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.nanoprefsync") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (global-name "com.apple.parsec.subscriptionservice") + (require-entitlement "com.apple.smoot.subscriptionservice")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.managedconfiguration.profiled") + (require-entitlement "com.apple.managedconfiguration.profiled-access")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.parsec.subscriptionservice.internal") + (require-entitlement "com.apple.private.subscriptionservice.internal")) + (require-all + (require-any (global-name "com.apple.accountsd.accessmanager") +(global-name "com.apple.accountsd.authmanager") +(global-name "com.apple.healthd.restriction")) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.bulletindistributord.server") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.SystemConfiguration.PPPController-priv") + (require-entitlement "com.apple.networking.vpn.configuration")) + (require-all + (global-name "com.apple.FileCoordination") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.allow")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.bulletinboard.observerconnection") + (require-entitlement "com.apple.bulletinboard.observer")) + (require-all + (global-name "com.apple.suggestd.suggestionmanager") + (require-entitlement "com.apple.private.suggestions")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.AOSNotification") + (require-entitlement "com.apple.aosnotification.aosnotifyd-access")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mobilestoredemod") + (require-entitlement "com.apple.private.mobilestoredemo.enabledemo")) + (require-all + (global-name "com.apple.suggestd.spotlight") + (require-entitlement "com.apple.private.suggestions.spotlight")) + (require-all + (global-name "com.apple.locationd.registration") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.twitterd") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.pegasus") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.mobilesafari-settings") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.WebSheet"))) + (require-all + (global-name "com.apple.harvestd.manager") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.biometrickitd") + (require-entitlement "com.apple.private.bmk.allow")) + (require-all + (global-name "com.apple.calaccessd") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.suggestd.events") + (require-entitlement "com.apple.private.suggestions.events")) + (require-all + (global-name "com.apple.absd") + (require-entitlement "abs-client" + (entitlement-value-regex #".+"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (global-name "com.apple.routined.registration") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (global-name "com.apple.locationd.synchronous") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (global-name "com.apple.rtcreportingd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) +(allow mach-register + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (require-not (global-name-regex #"-idswake$" #".+-idswake$")) + (require-any + (local-name "com.apple.assistant.contextprovider.") + (local-name "com.apple.iphone.axserver") + (local-name "com.apple.accessibility.gax.client") + (require-all + (require-any (global-name "com.apple.Music.MPMusicPlayerControllerInternal") +(global-name "com.apple.Music.MPMusicPlayerMigServerExists")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Music"))) + (require-all + (extension "com.apple.sandbox.application-group") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local ip "*:*") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (remote tcp "localhost:22")) + (require-not (remote tcp "localhost:23")) + (require-not (remote tcp "localhost:873")) + (require-not (remote tcp "localhost:62078")) + (require-any + (literal "/private/var/run/mDNSResponder") + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (literal "/private/var/run/syslog") + (literal "/private/var/run/printd") + (remote ip "*:*") + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents")))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.youtubeframework") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.atc") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.adtracking") + (preference-domain "com.apple.apsd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.ConfigServer") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.softwareupdateservicesd") +(preference-domain "com.apple.voicemail") +(preference-domain "com.apple.MobileAddressBook") +(preference-domain "com.apple.VoiceMemos") +(preference-domain "com.apple.XCTest") +(preference-domain "com.apple.certui") +(preference-domain "com.apple.gamekit") +(preference-domain "com.apple.imagent") +(preference-domain "com.apple.madrid") +(preference-domain "com.apple.managedconfiguration.janitor") +(preference-domain "com.apple.messagesbadgecontroller") +(preference-domain "com.apple.mobile.SyncMigrator") +(preference-domain "com.apple.mobileme.fmf.assistant") +(preference-domain "com.apple.mobilestoresettings") +(preference-domain "com.apple.mobiletimer") +(preference-domain "com.apple.mobilevpn") +(preference-domain "com.apple.network.eapclient.tls.TrustExceptions") +(preference-domain "com.apple.nike") +(preference-domain "com.apple.preferences.datetime") +(preference-domain "com.apple.preferences.network") +(preference-domain "itdbprepserver") +(preference-domain "mediaremote")) + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mmcs") + (preference-domain "com.apple.ubd") + (preference-domain "com.apple.da") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.itdbprep.server") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.compass") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.aggregated") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.LaunchServices") + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mms_override") + (preference-domain "com.apple.imdsmsrecordstore") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.OTASyncState") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.GMM") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.TTY") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.iqagent") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (preference-domain "com.apple.MailAccount-ExtProperties") +(preference-domain "com.apple.OTASyncAgent")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.homesharing") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2"))) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.AppSupport") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.AppSupport") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.system.get-wallpaper") + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.corevideo") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-any + (require-entitlement "com.apple.media.ringtones.read-only") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail")))) + (require-all + (preference-domain "com.apple.carrier") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.GEO") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.locationd") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.WebFoundation") + (require-entitlement "com.apple.private.signing-identifier" + (require-any + (entitlement-value "com.apple.mobilesafari") + (entitlement-value "com.apple.webbookmarksd") + (entitlement-value "com.apple.safarifetcherd") + (entitlement-value "com.apple.Safari.SocialHelper")))) + (require-all + (preference-domain "com.apple.medialibrary") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.books") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.avfoundation") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (preference-domain "com.apple.AppStore") +(preference-domain "com.apple.MobileStore")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))))) + (require-all + (preference-domain "com.apple.CoreDuet") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.coremedia") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mobilecal.alarmengine") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.DataMigration") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.stocks.watchkitextension"))) + (require-all + (preference-domain "com.apple.coreaudio") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.PeoplePicker") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.weather") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (require-any (preference-domain "com.apple.NanoMailKit") +(preference-domain "com.apple.internal.Voltaire") +(preference-domain "com.skyhookwireless.wps")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.mobilecal") + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.nanoprefsyncd") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.PassbookUIService"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private"))) +(allow user-preference-write + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.youtube.dp") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))) + (require-all + (require-any (preference-domain "com.apple.NanoMailKit") +(preference-domain "com.apple.internal.Voltaire") +(preference-domain "com.skyhookwireless.wps")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (require-any (preference-domain "com.apple.MailAccount-ExtProperties") +(preference-domain "com.apple.OTASyncAgent")) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (preference-domain "com.apple.assistant") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.OTASyncState") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.mail.composition") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilemail"))) + (require-all + (preference-domain "com.apple.springboard") + (require-entitlement "com.apple.system.set-alert-tone")) + (require-all + (preference-domain "com.apple.mobileipod") + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari")))) + (require-all + (preference-domain "com.apple.GMM") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps"))) + (require-all + (preference-domain "com.apple.cloud.quota") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.iCloudDriveApp"))) + (require-all + (preference-domain "com.apple.itunesstored") + (require-any + (require-entitlement "com.apple.container2") + (require-entitlement "com.apple.private.signing-identifier" + (require-any (entitlement-value "com.apple.iBooks") +(entitlement-value "com.apple.itunesu"))) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.mobilesafari"))))) +(allow process-info-codesignature + (target self) + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (debug-mode) + (require-entitlement "platform-application")) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension"))) +(allow process-info-dirtycontrol + (target self)) +(allow process-info-rusage + (target self) + (require-entitlement "com.apple.security.exception.process-info")) +(allow process-info-pidinfo + (target self) + (require-entitlement "com.apple.security.exception.process-info") + (require-all + (target others) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension"))) +(allow pseudo-tty) +(allow signal + (target self) + (require-all + (target others) + (require-entitlement "com.apple.DiagnosticExtensions.extension")) + (require-all + (target others) + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd")))) +(allow sysctl-read + (sysctl-name "net.routetable.") + (sysctl-name "net.statistics") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "kern.bootsessionuuid") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.DiagnosticExtensions.extension")) + (require-all + (sysctl-name "kern.proc.all") + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.webbookmarksd"))) + (require-all + (require-not (sysctl-name "sysctl.proc_native")) + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (sysctl-name "kern.hostname") + (sysctl-name "hw.machine"))) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow system-info + (require-all + (info-type "net.link.addr") + (require-entitlement "fairplay-client") + (require-not (require-entitlement "com.apple.private.MobileGestalt.AllowedProtectedKeys")))) +(allow system-privilege) +(allow system-socket + (socket-domain AF_ROUTE) + (require-all + (socket-domain AF_SYSTEM) + (socket-protocol 2)) + (require-all + (socket-domain 39) + (require-any + (require-entitlement "com.apple.private.signing-identifier" + (entitlement-value "com.apple.Maps")) + (require-entitlement "com.apple.network.multipath-tcp")))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb.xml new file mode 100644 index 0000000..c2510dc --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/container.sb.xml @@ -0,0 +1,27 @@ + + + + + + + + + +]> + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb new file mode 100644 index 0000000..0c26d88 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb @@ -0,0 +1,479 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.containermanagerd") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath "/private/var/containers") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers" #"^/private/var/[-0-9A-F]+/Library/Backup/SystemContainers" #"^/private/var/Users/[^/]+/Library/Backup/SystemContainers") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers" #"^/private/var/[-0-9A-F]+/Containers" #"^/private/var/Users/[^/]+/Containers") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/root/Library/MobileContainerManager") +(literal "/private/var/root/Library/MobileContainerManager.") +(subpath "/private/var/root/Library/Logs/MobileContainerManager") +(literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") +(subpath "/private/var/installd/Library/Caches") +(subpath "/private/var/networkd/Containers") +(literal "/private/var/") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/MobileContainerManager") +(subpath-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager") +(literal-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager.")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal "/private/var/installd/Library") +(literal "/private/var/installd/Library/Logs")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.containermanagerd") + (require-any (subpath "/private/var/root/Library/MobileContainerManager") +(literal "/private/var/root/Library/MobileContainerManager.") +(subpath "/private/var/root/Library/Logs/MobileContainerManager") +(literal "/private/var/root/Library/Preferences/com.apple.containermanagerd.plist") +(subpath "/private/var/installd/Library/Caches") +(subpath "/private/var/networkd/Containers") +(literal "/private/var/") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/MobileContainerManager") +(subpath-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager") +(literal-prefix "${FRONT_USER_HOME}/Library/MobileContainerManager.")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/mobile/Library/Caches/com.apple.containermanagerd" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.containermanagerd" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.containermanagerd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/containers") + (regex #"^/private/var/mobile/Library/Backup/SystemContainers" #"^/private/var/euser[0-9]+/Library/Backup/SystemContainers" #"^/private/var/[-0-9A-F]+/Library/Backup/SystemContainers" #"^/private/var/Users/[^/]+/Library/Backup/SystemContainers") + (regex #"^/private/var/mobile/Containers" #"^/private/var/euser[0-9]+/Containers" #"^/private/var/[-0-9A-F]+/Containers" #"^/private/var/Users/[^/]+/Containers") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (require-any (literal "/private/var/installd/Library") +(literal "/private/var/installd/Library/Logs")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.containermanagerd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/containermanagerd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb new file mode 100644 index 0000000..ffff534 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb @@ -0,0 +1,194 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/timezone") + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (vnode-type CHARACTER-DEVICE) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/usr/lib") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/root/Library/Caches") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath "/System/Library/Caches/com.apple.coresymbolicationd") +(subpath "/private/var/root/Library/Caches/com.apple.coresymbolicationd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal "/private/var/root/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/coresymbolicationd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb new file mode 100644 index 0000000..aca782b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb @@ -0,0 +1,184 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/logs/WirelessLibraryLogs") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath-prefix "${HOME}/Library/Logs") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/logs/WirelessLibraryLogs") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Logs") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/cplogd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb new file mode 100644 index 0000000..108cc72 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb @@ -0,0 +1,96 @@ +(version 1) +(deny default) +(allow file-link) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.ctkd.slot-client") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ctkd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb new file mode 100644 index 0000000..0762571 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb @@ -0,0 +1,665 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Mail") + (subpath-prefix "${HOME}/Library/Notes") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/AddressBook/AddressBookImages.sqlitedb") +(literal-prefix "${HOME}/Library/AddressBook/AddressBookImages.sqlitedb-journal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBookImages.sqlitedb-shm") +(literal-prefix "${HOME}/Library/AddressBook/AddressBookImages.sqlitedb-wal")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/AppleInternal/Library/Frameworks") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock") +(literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.activesync") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/")) + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-journal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-shm") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-wal") +(literal-prefix "${HOME}/Library/AddressBook")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/private/var/db/timezone") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/DataAccess") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Fonts") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.launchd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.dataaccess.dataaccessd") + (subpath-prefix "${HOME}/Library/DataAccess") + (subpath-prefix "${HOME}/Library/Mail") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Library/Caches/DataAccess") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-journal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-shm") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-wal") +(literal-prefix "${HOME}/Library/AddressBook")) + (require-any (literal-prefix "${HOME}/Library/Safari/com.apple.Bookmarks.lock") +(literal-prefix "${HOME}/Library/Preferences/com.apple.dataaccess.activesync") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/")) + (subpath-prefix "${HOME}/Library/Calendar") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Safari")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd")) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/AddressBook")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.dataaccess.dataaccessd"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.safarifetcherd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.calaccessd.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.mobilenotes") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.dataaccess.dataaccessd") + (preference-domain "com.apple.persistentconnection-mcc") + (preference-domain "com.apple.message") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.DataAccess.BehaviorOptions") + (require-any (preference-domain "com.apple.dataaccess.activesync") +(preference-domain "com.apple.dataaccess.babysitter")) + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.dataaccess.activesync") +(preference-domain "com.apple.dataaccess.babysitter")) + (preference-domain "com.apple.persistentconnection-mcc") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.dataaccess.dataaccessd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb.xml new file mode 100644 index 0000000..16c4ab7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/dataaccessd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb new file mode 100644 index 0000000..0ea88df --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb @@ -0,0 +1,213 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath "/private/var/db/datadetectors") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/db/datadetectors") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/datadetectors.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb new file mode 100644 index 0000000..972a0b8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb @@ -0,0 +1,200 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/private/var/containers/Bundle") + (literal "/private/etc/hosts") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-priv-task-port) +(allow network-inbound + (local tcp "localhost:*") + (remote tcp "localhost:*")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow system-debug) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb.xml new file mode 100644 index 0000000..923f559 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/debugserver.sb.xml @@ -0,0 +1,45 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb new file mode 100644 index 0000000..911ffe7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb @@ -0,0 +1,391 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath "/System/Library/CacheDelete") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${HOME}/Library/Logs/CacheDelete") +(subpath-prefix "${HOME}/Library/Caches/com.apple.cache_delete") +(subpath "/AppleInternal/Library/CacheDelete")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/Logs/CacheDelete") +(subpath-prefix "${HOME}/Library/Caches/com.apple.cache_delete") +(subpath "/AppleInternal/Library/CacheDelete")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "cache_delete.fb_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name-regex #"^com[.]apple[.].+cache-delete$") + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.mobile.cache_delete_") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobile.keybagd.xpc") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name-regex #"^com[.]apple[.].+[Cc]ache[Dd]elete$") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:443") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.cache_delete") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.cache_delete")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-fsctl + (fsctl-command (_IO "h" 24)) + (fsctl-command (_IO "h" 27)) + (fsctl-command (_IO "h" 29)) + (fsctl-command (_IO "h" 28))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/deleted.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb new file mode 100644 index 0000000..4910f28 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb @@ -0,0 +1,451 @@ +(version 1) +(deny default) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/AddressBook") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (subpath-prefix "${HOME}/Library/DuetExpertCenter") +(subpath-prefix "${HOME}/Library/Logs/CallHistory") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/proactive_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/.proactive_") +(literal-prefix "${HOME}/Library/Logs/coreduetd.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.duetexpertd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (subpath-prefix "${HOME}/Library/Logs/CrashReporter")) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (subpath-prefix "${HOME}/Library/DuetExpertCenter") +(subpath-prefix "${HOME}/Library/Logs/CallHistory") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/proactive_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/.proactive_") +(literal-prefix "${HOME}/Library/Logs/coreduetd.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.duetexpertd")) + (subpath-prefix "${HOME}/Library/CoreDuet") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin") + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-entitlement "com.apple.Contacts.database-deny"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.imagent.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (require-any (global-name "com.apple.coreduetd.context") +(global-name "com.apple.coreduetd.knowledgebase")) + (global-name "com.apple.coreduetd.batterysaver") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.routined.registration") + (require-any (global-name "com.apple.atc.xpc.sessions") +(global-name "com.apple.duet.expertcenter")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.calaccessd") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.springboard.services") + (global-name "com.apple.marco") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.callkit.callcontrollerhost") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.message") + (require-any (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") +(preference-domain "com.apple.duetexpertd")) + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobilecal") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.CrashReporter") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.conference") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.DuetExpertCenter.AppPredictionExpert") +(preference-domain "com.apple.duetexpertd")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaremote")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/duetexpertd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb new file mode 100644 index 0000000..a1f32f9 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb @@ -0,0 +1,743 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}") +(literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (require-any (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/MDM.plist") +(literal "/usr/libexec/findmydeviced") +(literal "/") +(literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/MDM.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/MDM.plist")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/empty") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-data + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.findmydeviced") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.findmydeviced") +(literal-prefix "${FRONT_USER_HOME}") +(literal-prefix "${HOME}/Library/Preferences/com.apple.icloud.findmydeviced")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]icloud[.]findmydeviced[.]watch") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.findmydeviced"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/euser[0-9]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/[-0-9A-F]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$" #"^/private/var/Users/[^/]+/Library/VoiceTrigger/SAT/[^/]+/audio/enrollment_completed$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "ProvInfoIOKitUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "findmydeviced.boot_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.fig.movie") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.assistant.settings") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.absinthed") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.adid") + (require-any (global-name "com.apple.iapd.xpc") +(global-name "com.apple.iap2d.xpc")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.networkd") + (global-name "com.apple.ak.anisette.xpc") + (require-any (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.mobile.obliteration") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.marco") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.absd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.migration") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.AOSNotification.notbackedup") +(preference-domain "com.apple.managedconfiguration.notbackedup") +(preference-domain "com.apple.Security")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.icloud.findmydeviced") + (preference-domain "com.apple.DataMigration")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/findmydeviced.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb new file mode 100644 index 0000000..99af32a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb @@ -0,0 +1,627 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/usr/libexec/fmfd") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/usr/libexec") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/empty") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.fmfd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.fmfd")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.icloud.fmfd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.icloud.fmfd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.icloud.fmfd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.icloud.fmfd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.icloud.fmfd") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.aps.alertprovider.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.apsalerts") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.da") + (preference-domain "com.apple.icloud.fmfd") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.icloud.fmfd.notbackedup") +(preference-domain "com.apple.mobileme.fmf1")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.icloud.fmfd") + (require-any (preference-domain "com.apple.icloud.fmfd.notbackedup") +(preference-domain "com.apple.mobileme.fmf1"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/fmfd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb new file mode 100644 index 0000000..0a17bfb --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb @@ -0,0 +1,198 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.pfd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound) +(allow network-bind) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (local ip "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb.xml new file mode 100644 index 0000000..b310806 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ftp-proxy-embedded.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb new file mode 100644 index 0000000..e97a8c6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb @@ -0,0 +1,678 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/GameKit") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.gamed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.gamed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") +(subpath-prefix "${HOME}/Library/Logs/GameKit") +(subpath-prefix "${HOME}/Library/Caches/GameKit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") +(subpath-prefix "${HOME}/Library/GameKit")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/private/var/containers/Bundle") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/dev/aes_0") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/usr/libexec/gamed") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/Applications") + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/usr/local/bin/gamecenterctl") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.gamed") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.gamed") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/gamed") +(subpath-prefix "${HOME}/Library/Logs/GameKit") +(subpath-prefix "${HOME}/Library/Caches/GameKit") +(subpath-prefix "${HOME}/Library/Caches/com.apple.gamed") +(subpath-prefix "${HOME}/Library/GameKit")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.gamecenter") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.fig.movie") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "PurpleSystemAppPort") + (require-any (global-name "com.apple.authkit.xpc") +(global-name "com.apple.gamecenter.gsEvents")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.fairplayd") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.mobilemail.services.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.imagent.embedded.auth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "PurpleSystemEventPort") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.GameController.gamecontrollerd") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote ip "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.gamecenter") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.conference") + (preference-domain "com.apple.gamed") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.gamecenter")) +(allow process-exec* + (literal "/usr/libexec/gamed")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gamed.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb new file mode 100644 index 0000000..b3f00f7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb @@ -0,0 +1,20 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb.xml new file mode 100644 index 0000000..941d510 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geocorrectiond.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb new file mode 100644 index 0000000..1b28385 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb @@ -0,0 +1,572 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/MapTiles") +(subpath-prefix "${HOME}/Library/Caches/PlaceData") +(subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Maps") +(subpath-prefix "${HOME}/Library/GeoServices")) + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/Maps/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-wal") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-shm") +(literal-prefix "${HOME}/Library/Caches/MapTiles/MapTiles.sqlitedb-journal") +(literal-prefix "${HOME}/Library/Caches/MapTiles") +(subpath-prefix "${HOME}/Library/Caches/PlaceData") +(subpath-prefix "${HOME}/Library/Caches/com.apple.GeoServices") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Maps") +(subpath-prefix "${HOME}/Library/GeoServices")) + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/Maps/MapTiles")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/MapTiles")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.marco") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.gmmd.cookie") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.WebFoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.GMM") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.GMM")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/geod.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb new file mode 100644 index 0000000..329c280 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb @@ -0,0 +1,522 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nano-complications$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.watchkit.imagecache") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gizmoappd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gizmoappd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.lsd.modifydb") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cache_delete") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.misagent") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.healthd.server") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.marco") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.appconduitd.application-manager") +(global-name "com.apple.carousel.backlightxpc") +(global-name "com.apple.carousel.glanceservice") +(global-name "com.apple.carousel.tilenavigation")) + (global-name "com.apple.nanoprefsync") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.sockpuppet.activeComplications") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.nanoprefsyncd") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.gizmoappd") + (preference-domain "com.apple.sockpuppet.activeComplications")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gizmoappd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb new file mode 100644 index 0000000..2ceb32d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb @@ -0,0 +1,482 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd"))) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (subpath "/usr/share") + (literal "/dev/ptmx") + (subpath "/System/Library") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (vnode-type CHARACTER-DEVICE) + (extension "com.apple.sandbox.executable") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/GPUTools") +(subpath "/private/var/root/Library/Caches/com.apple.opengl")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.gputoolsd") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.gputoolsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "IOSurfaceRootUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coresymbolicationd") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.lockdown.host_watcher") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.appwatchdog") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-priv-task-port) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/gputoolsdhelper.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (local tcp "localhost:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-exec* + (literal "/Developer/usr/libexec/gputoolsd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "sysctl.proc_native") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb.xml new file mode 100644 index 0000000..ccb1c4c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/gputoolsd.sb.xml @@ -0,0 +1,48 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb new file mode 100644 index 0000000..f1ef282 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb @@ -0,0 +1,290 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (literal-prefix "${PROCESS_TEMP_DIR}/HealthWrap-") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${PROCESS_TEMP_DIR}/HealthWrap-") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.private.healthd.server-internal") + (global-name "com.apple.healthd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.cloudd") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthcloudd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb new file mode 100644 index 0000000..3d23f70 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb @@ -0,0 +1,578 @@ +(version 1) +(deny default) +(allow file-read* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (subpath "/private/var/preferences/Logging") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.healthd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.healthd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") +(literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches") +(subpath-prefix "${HOME}/Library/Health") +(literal-prefix "${HOME}/Library/")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath "/Applications/Fitness.app") +(subpath "/Applications/Health.app")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/awd") + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.healthd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.healthd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/HealthKit") +(literal-prefix "${HOME}/Library/Logs/awd/awd-healthd.log") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-journal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-shm") +(literal-prefix "${HOME}/Library/CompanionSyncCaches/com.apple.private.alloy.health.sync.low-wal") +(literal-prefix "${HOME}/Library/CompanionSyncCaches") +(subpath-prefix "${HOME}/Library/Health") +(literal-prefix "${HOME}/Library/")) + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]healthd" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]nanolifestyle[.]privacy") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]private[.]alloy[.]health[.]sync[.]low") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]pairedsync[.]healthd[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/com[.]apple[.]pairedsync[.]healthd[.]") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]health[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/CompanionSyncCaches")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/Health/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.routined.registration") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.springboard.services") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.marco") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.apsd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.server.bluetooth.le.att.xpc") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.mobilephone") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.ET") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.companionsync") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.conference") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (require-any (preference-domain "com.apple.dt.Xcode") +(preference-domain "com.apple.healthlite")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.Fitness") +(preference-domain "com.apple.nanolifestyle") +(preference-domain "com.apple.nanolifestyle.privacy") +(preference-domain "com.apple.SOS")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.healthd") + (preference-domain "com.apple.ET") + (require-any (preference-domain "com.apple.Fitness") +(preference-domain "com.apple.nanolifestyle") +(preference-domain "com.apple.nanolifestyle.privacy") +(preference-domain "com.apple.SOS"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/healthd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb new file mode 100644 index 0000000..eb7bc70 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb @@ -0,0 +1,658 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/sbin") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.iap2d") +(subpath-prefix "${HOME}/Library/Logs/com.apple.ioam") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/haywire") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iapd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/iap2d") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mp") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/Panics") +(literal-prefix "${HOME}/Library/Preferences/com.apple.assistivetouchd.enabled.launchd") +(subpath-prefix "${HOME}/Media/Radio") +(subpath-prefix "${HOME}/Media/iTunes_Control")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.iapd") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.iapd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "AppleAuthCPUserClient") +(iokit-user-client-class "AppleUSBHostDeviceUserClient") +(iokit-user-client-class "IOAccessoryPortUserClient")) + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (require-any (iokit-user-client-class "AppleUSBHostInterfaceUserClient") +(iokit-user-client-class "IOAccessoryManagerUserClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (require-all (require-not (iokit-property "PowerState")) +(require-not (iokit-property "VirtualMode"))) + (require-all + (require-any (iokit-property "Authenticated") +(iokit-property "InterfaceProperties")) + (iokit-user-client-class "IOUSBHostDevice"))) +(allow iokit-get-properties + (require-any (iokit-user-client-class "IOUSBHostInterface") +(iokit-user-client-class "IOUSBHostDevice") +(iokit-user-client-class "IOMikeyBusDevice") +(iokit-user-client-class "IODTNVRAM") +(iokit-user-client-class "IOAccessoryManager") +(iokit-user-client-class "IOAccessoryEAInterface") +(iokit-user-client-class "AppleAuthCP")) + (require-any (iokit-property "IOClassNameOverride") +(iokit-property "IORegistryEntryPropertyKeys")) + (iokit-property "IOClass") + (require-any (iokit-property "AppleUSBCableType") +(iokit-property "IOName") +(iokit-property "IONameMatch") +(iokit-property "IONameMatched")) + (require-all + (iokit-property "iommu-present") + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "PowerState") +(iokit-property "VirtualMode")) + (iokit-user-client-class "IODPController")) + (require-all + (iokit-property "AppleJPEG") + (iokit-user-client-class "AppleJPEGDriver")) + (require-all + (iokit-property "kUSBBusCurrentAllocation") + (iokit-user-client-class "AppleUSBHostPort")) + (require-all + (require-any (iokit-property "assistant") +(iokit-property "car-integration") +(iokit-property "low-power-wallet-mode") +(iokit-property "iap2-protocol-supported")) + (iokit-user-client-class "IOPlatformDevice")) + (require-all + (require-any (iokit-property "IOAccessoryDevicePort") +(iokit-property "IOAccessoryPortManagerPrimaryPort") +(iokit-property "IOAccessoryTransportType")) + (iokit-user-client-class "IOAccessoryTransport")) + (require-all + (iokit-property "development-cert") + (iokit-user-client-class "IOService")) + (require-all + (require-any (iokit-property "kUSBDesiredChargingCurrent") +(iokit-property "kUSBFailedRequestedPower")) + (require-any (iokit-connection "AppleUSB20CameraKitHub") +(iokit-connection "AppleUSB30CameraKitHub"))) + (require-all + (require-any (iokit-property "DisplayPipePlaneBaseAlignment") +(iokit-property "hdcp-hoover-protocol")) + (iokit-user-client-class "IOMobileFramebuffer"))) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (require-any (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+"))) +(allow network-bind + (require-all + (subpath-prefix "${FRONT_USER_HOME}") + (regex #"^/private/var/mobile/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/euser[0-9]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/[-0-9A-F]+/Library/ExternalAccessory/ea[.0-9]+$" #"^/private/var/Users/[^/]+/Library/ExternalAccessory/ea[.0-9]+$"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote udp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.UIKit") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.TelephonyUtilities") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.assistant") + (preference-domain "com.apple.suggestions") + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.da") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.videos") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.carplay") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd")) + (preference-domain "com.apple.assistant.logging") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.videos") + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.iap2d") +(preference-domain "com.apple.iaptransportd")) + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.mediaremote") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (require-any (literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iap2d") +(literal "/System/Library/PrivateFrameworks/IAP.framework/Support/iapd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-kext-load + (require-any (kext-bundle-id "com.apple.driver.usb.cdc.ecm") +(kext-bundle-id "com.apple.driver.usb.cdc.ncm") +(kext-bundle-id "com.apple.driver.usb.cdc") +(kext-bundle-id "com.apple.driver.usb.IOUSBHostHIDDevice") +(kext-bundle-id "com.apple.driver.usb.networking") +(kext-bundle-id "com.apple.driver.AppleUSBDeviceAudioController") +(kext-bundle-id "com.apple.driver.AppleUSBAudio"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb.xml new file mode 100644 index 0000000..9c877fa --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/iapd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb new file mode 100644 index 0000000..7be0e0c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb @@ -0,0 +1,625 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.identityservices.deliver") + (subpath-prefix "${HOME}/Library/IdentityServices")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/System/Library") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/AppleInternal") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.setmme") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") +(literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") +(subpath-prefix "${HOME}/Library/IdentityServices") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}")) + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (extension "com.apple.identityservices.send") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/usr/local/bin") + (debug-mode)) + (require-all + (require-any (literal "/bin/sh") +(literal "/usr/bin/lskq")) + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal "/usr/local/bin/figplaySS") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (literal "/dev/tty") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/awd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-identityservicesd.log") +(literal-prefix "${HOME}/Library/Preferences/com.apple.ids.service.") +(subpath-prefix "${HOME}/Library/IdentityServices") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.identityservicesd") +(literal-prefix "${FRONT_USER_HOME}")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.identityservices.send") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (literal "/dev/tty") + (debug-mode)) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.WirelessCoexManager") + (global-name "com.apple.coreduetd") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.awdd") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.datamigrator") + (global-name "com.apple.absinthed") + (require-any (global-name "com.apple.idscredentialsagent.embedded.auth") +(global-name "com.apple.imtransferservices.IMTransferAgent")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name-regex #"-idswake$" #".+-idswake$") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.server.bluetooth.le.pipe.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.apsd") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.absd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.audio.SystemSoundServer-iOS") + (debug-mode)) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local ip "*:*")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.marco") + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.registration") + (require-any (preference-domain "com.apple.identityservicesd") +(preference-domain "com.apple.identityservices.idstatuscache") +(preference-domain "com.apple.ids.deviceproperties") +(preference-domain "com.apple.ids.subservices")) + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.migration") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.da") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.imessage") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.purplebuddy.notbackedup") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.coreaudio") + (debug-mode))) +(allow user-preference-write + (require-any (preference-domain "com.apple.identityservicesd") +(preference-domain "com.apple.identityservices.idstatuscache") +(preference-domain "com.apple.ids.deviceproperties") +(preference-domain "com.apple.ids.subservices")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.conference")) +(allow process-exec* + (require-all + (literal "/usr/local/bin/figplaySS") + (debug-mode))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/identityservicesd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb new file mode 100644 index 0000000..b5ceb3f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb @@ -0,0 +1,320 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/usr/libexec") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/containers/Bundle") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/MobileIdentityData") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath "/private/var/installd") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/usr/libexec/installd") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (literal "/com.apple.xpc.launchd.bootstrap.plist")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/installd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (subpath "/private/var/containers/Bundle") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-sem* + (ipc-posix-name "installd.firstboot_check")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.online-auth-agent.xpc") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.misagent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.modifydb") + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/installd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb new file mode 100644 index 0000000..728f980 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb @@ -0,0 +1,625 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media/Downloads")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath-prefix "${HOME}/Media") + (literal "/dev/ptmx") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.itunesstored") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/Snapshots") +(subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/MusicLibrary") +(subpath-prefix "${HOME}/Library/com.apple.itunesstored") +(literal-prefix "${HOME}/Library/")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/System/Library") + (subpath "/private/var/containers/Bundle") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/sharedCaches")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.itunesstored") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/Caches/Snapshots") +(subpath-prefix "${HOME}/Library/Caches/com.apple.storeServices.analytics") +(subpath-prefix "${HOME}/Library/Caches/com.apple.iTunesStore") +(subpath-prefix "${HOME}/Library/Logs/com.apple.itunesstored") +(subpath-prefix "${HOME}/Library/MusicLibrary") +(subpath-prefix "${HOME}/Library/com.apple.itunesstored") +(literal-prefix "${HOME}/Library/")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.itunesstored")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.cache_delete") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mediaartworkd.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.absinthed") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.adid") + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.ondemandd.itunesstored") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.modifydb") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.biometrickitd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.apsd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.absd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (preference-domain "com.apple.persistentconnection") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.itunesstored")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/itunesstored.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb new file mode 100644 index 0000000..5712529 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb @@ -0,0 +1,563 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}"))))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$") + (require-all + (require-not (ipc-posix-name "apple.shm.notification_center")) + (ipc-posix-name "apple.cfprefs."))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.assertiond.expiration") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.fig.movie") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.CARenderServer") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.system.notification_center")) + (require-any + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow mach-register + (local-name "com.apple.iphone.axserver") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow process-info-codesignature + (target self) + (require-entitlement "com.apple.security.exception.process-info")) +(allow pseudo-tty) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "kern.maxvnodes") + (sysctl-name "kern.hostname") + (sysctl-name "hw.machine"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb.xml new file mode 100644 index 0000000..d78d38c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/keyboard.sb.xml @@ -0,0 +1,29 @@ + + + + + + + + + +]> + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb new file mode 100644 index 0000000..12f1b6f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb @@ -0,0 +1,424 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension-class "com.apple.app-sandbox.read") + (extension-class "com.apple.librarian.ubiquity-container"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension-class "com.apple.librarian.ubiquity-revision")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (require-any (subpath-prefix "${HOME}/Library/Application Support/Librarian") +(subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log")) + (subpath "/Developer") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/dev/ptmx") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (vnode-type CHARACTER-DEVICE) + (subpath-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/db/timezone") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Application Support") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Application Support/Librarian") +(subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/librariand.log")) + (literal-prefix "${HOME}/Library/Application Support") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.ubd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.appleaccount") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.librariand") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.appleaccount") + (preference-domain "com.apple.librariand")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/librariand.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb new file mode 100644 index 0000000..1248534 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb @@ -0,0 +1,324 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/usr/libexec/limitadtrackingd") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.iad") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.iad")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.AdSheetPhone.management") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.cloudd") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.persistentconnection") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.AdLib") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/limitadtrackingd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb new file mode 100644 index 0000000..c357f3e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb @@ -0,0 +1,422 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath-prefix "${FRONT_USER_HOME}/Media") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (subpath "/private/var/root/Library/Lockdown") +(literal "/private/var/root/Library/Preferences/com.apple.mobile.lockdownd.plist") +(subpath "/private/var/preferences/SystemConfiguration")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath "/private/var/logs") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/run/lockdown.sock") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath "/Applications/Preferences.app") +(subpath "/AppleInternal/Lockdown") +(literal "/usr/libexec/lockdownd") +(literal "/private/var/db/launchd.db/com.apple.launchd/overrides.plist")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/dev/dtracehelper") + (subpath "/private/var/run/lockdown") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/containers") + (vnode-type DIRECTORY)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/Info[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/[.]bundle/[^/]+[.]lproj$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj/" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]bundle/[^/]+[.]lproj$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]bundle/Info[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj/" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/((.*[.]bundle/|[.]bundle/[^/]+)|.+[.]bundle/[^/]+)[.]lproj$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Containers") + (vnode-type DIRECTORY)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath-prefix "${PROCESS_TEMP_DIR}/MediaCache") + (vnode-type DIRECTORY)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Media") + (vnode-type DIRECTORY)) + (require-all + (require-any (subpath-prefix "${FRONT_USER_HOME}/Applications") +(subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.WebAppCache") +(subpath-prefix "${FRONT_USER_HOME}/Library/Calendar") +(subpath-prefix "${FRONT_USER_HOME}/Library/Notes") +(subpath-prefix "${FRONT_USER_HOME}/Library/Voicemail")) + (vnode-type DIRECTORY)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${FRONT_USER_HOME}/Media") + (require-any (subpath "/private/var/root/Library/Lockdown") +(literal "/private/var/root/Library/Preferences/com.apple.mobile.lockdownd.plist") +(subpath "/private/var/preferences/SystemConfiguration")) + (subpath "/private/var/run/lockdown") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/run/lockdown.sock") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/logs") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/var/run/lockdown_first_run") + (vnode-type REGULAR-FILE))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (literal "/private/var/db/timezone") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "AppleEffaceableStorageUserClient") +(iokit-user-client-class "AppleNANDFTLUserClient")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties + (iokit-property "auto-boot")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.lockdown.host_watcher") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.atc") + (global-name "com.apple.mobile.installd") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.webinspector") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.aggregated") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.trustd") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.AOSNotification") +(global-name "com.apple.mobile.assertion_agent") +(global-name "com.apple.mobile.installation_proxy") +(global-name "com.apple.mobile.insecure_notification_proxy") +(global-name "com.apple.mobile.notification_proxy") +(global-name "com.apple.afcd") +(global-name "com.apple.atc2") +(global-name "com.apple.crashreportcopymobile") +(global-name "com.apple.crash_mover") +(global-name "com.apple.streaming_zip_conduit") +(global-name "com.apple.syslog_relay") +(global-name "lockdown.")) + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.ait.client") + (global-name "com.apple.timed.xpc") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local tcp "*:*") + (literal "/private/var/run/lockdown.sock") + (subpath "/private/var/run/lockdown")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockbot") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.purplebuddy") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lockdownd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb new file mode 100644 index 0000000..56ef6e0 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb @@ -0,0 +1,443 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/oslog") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.logd.read-only") + (require-any + (subpath "/private/var/db/diagnostics") + (subpath "/private/var/db/uuidtext"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/dev/oslog") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (subpath "/private/var/log") +(subpath "/private/var/root/Library/Logs")) + (literal "/dev/ptmx") + (subpath "/private/var/db/uuidtext") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (subpath "/private/var/logs/system_logs.logarchive") + (subpath "/private/var/db/diagnostics") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/containers/Bundle") + (subpath "/private/var/logs") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (file-mode #o0100) + (file-mode #o0010) + (file-mode #o0001))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/db/diagnostics") + (subpath "/private/var/db/uuidtext") + (subpath "/private/var/logs/system_logs.logarchive") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/oslog") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-any (subpath "/private/var/log") +(subpath "/private/var/root/Library/Logs")) + (subpath "/private/var/logs") + (subpath-prefix "${FRONT_USER_HOME}/Library/Logs")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-priv-host-port) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-kext-query) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb.xml new file mode 100644 index 0000000..b552447 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/logd.sb.xml @@ -0,0 +1,35 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb new file mode 100644 index 0000000..33bfe8c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb @@ -0,0 +1,345 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${HOME}/Library/Logs/useractivityd") +(subpath-prefix "${HOME}/Library/Logs/Handoff") +(subpath-prefix "${HOME}/Library/Logs/Transport")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/useractivityd") +(subpath-prefix "${HOME}/Library/Logs/Handoff") +(subpath-prefix "${HOME}/Library/Logs/Transport")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.coreservices.uauseractivitypasteboardclient.xpc") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.bird") + (global-name "com.apple.securityd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.SharedWebCredentials") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.mobileipod") + (require-any (preference-domain "com.apple.coreservices.useractivityd") +(preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites")) + (preference-domain "com.apple.Sharing") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.logging") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.mediaremote") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.mediaremote") + (require-any (preference-domain "com.apple.coreservices.useractivityd") +(preference-domain "com.apple.coreservices.useractivityd.dynamicuseractivites"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb.xml new file mode 100644 index 0000000..f0d97f4 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/lsuseractivityd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb new file mode 100644 index 0000000..01c500f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb @@ -0,0 +1,137 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (literal "/dev/dtracehelper") + (literal "/private/var/run/mDNSResponder") + (require-any (regex #"/private/var/folders/[^/]+/[^/]+/C/mds/?") +(regex #"/private/var/folders/[^/]+/[^/]+/-Caches-/mds/?")) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/private/var/db/dyld") + (subpath "/usr/share")))) +(allow file-read-data + (require-any (literal "/private/var/db/crls/crlcache.db") +(subpath "/private/var/db/mds") +(subpath "/private/var/tmp/mds") +(literal "/Library/Keychains/System.keychain")) + (require-all + (require-not (literal "/Library/Keychains/")) + (require-any + (literal "/dev/console") + (require-any (literal "/usr/sbin/mDNSResponder") +(literal "/Library/Preferences/com.apple.mDNSResponder.plist") +(literal "/Library/Preferences/com.apple.security.") +(literal "/Library/Preferences/com.apple.crypto.plist") +(literal "/Library/Preferences/SystemConfiguration/preferences.plist") +(literal "/Library/Preferences/SystemConfiguration/com.apple.nat.plist") +(literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist") +(subpath "/Library/Preferences/Logging") +(literal "/Library/Preferences/ByHost/.GlobalPreferences.") +(literal "/Library/Preferences/.GlobalPreferences.") +(literal "/Library/Security/Trust Settings/Admin.plist") +(literal "/private/etc") +(subpath "/AppleInternal/Library/Preferences/Logging") +(subpath "/System/Library/Preferences/Logging")) + (literal "/private/var/preferences/SystemConfiguration/preferences.plist") + (literal "/usr/sbin") + (literal "/private/etc/hosts")))) +(allow file-read-metadata) +(allow file-write* + (require-any (regex #"/private/var/folders/[^/]+/[^/]+/C/mds/?") +(regex #"/private/var/folders/[^/]+/[^/]+/-Caches-/mds/?")) + (regex #"^/private/var/db/mds/[0-9]+/" #"^/private/var/db/mds/[0-9]+$") + (literal "/private/var/run/mDNSResponder") + (regex #"^/private/var/tmp/mds/[0-9]+/" #"^/private/var/tmp/mds/[0-9]+$") + (require-all + (literal "/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/console") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))) +(allow iokit-open + (require-any (iokit-user-client-class "NVEthernetUserClientMDNS") +(iokit-user-client-class "mDNSOffloadUserClient") +(iokit-user-client-class "wlDNSOffloadUserClient")) + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (require-any (global-name "com.apple.bsd.dirhelper") +(global-name "com.apple.blued") +(global-name "com.apple.distributed_notifications.2") +(global-name "com.apple.mDNSResponder_Helper") +(global-name "com.apple.webcontentfilter.dns") +(global-name "com.apple.awacs")) + (global-name "com.apple.snhelper") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.nehelper") + (global-name "com.apple.wifi.manager") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.ocspd") + (global-name "com.apple.networkserviceproxy") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.SystemConfiguration.configd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.networkd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.SecurityServer") +(global-name "com.apple.coreservices.quarantine-resolver")) + (global-name "com.apple.mDNSResponderHelper")) +(allow mach-register + (global-name "com.apple.d2d.ipc")) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow sysctl-read) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb.xml new file mode 100644 index 0000000..438d67b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mDNSResponder.sb.xml @@ -0,0 +1,52 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb new file mode 100644 index 0000000..3cec6fd --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb @@ -0,0 +1,693 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Media/DCIM"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath "/Library/Audio/Tunings/Generic/AU") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/usr/local/lib") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")) + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.photos") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaanalysisd") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.coremedia.compressionsession") + (global-name "com.apple.xpc.activity.unmanaged") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.sandboxserver") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.assetsd.changehub") + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mediaanalysisd") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.VideoProcessing") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.VideoProcessing") + (preference-domain "com.apple.mediaanalysis") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.mediaanalysisd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaanalysisd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb new file mode 100644 index 0000000..b2ebcf7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb @@ -0,0 +1,970 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.rtcreporting.upload") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference/logs")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (literal "/usr/local/lib/libAudioDiagnostics.dylib") + (subpath "/Library/Audio/Plug-Ins") + (extension "com.apple.sandbox.executable")) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Media/Recordings") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/private/var/wireless/Library/Logs/awd") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/AppleInternal/Library/Preferences/com.apple.airplay.dashboard.plist") + (subpath-prefix "${HOME}/Media/Podcasts") + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.mediaserverd.read") + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.mediaserverd.read-write") + (require-any (subpath "/Library") +(subpath "/usr/local/share/firmware/isp") +(literal "/private/var/Managed Preferences/mobile/com.apple.springboard.plist") +(literal "/AppleInternal/Library/Conference/Environments.plist")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-mediaserverd.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") +(literal-prefix "${HOME}/Library/Logs/AirPlay.log") +(literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") +(subpath-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.logMedia/iTunes_Control/Music") +(subpath-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.logMedia/PhotoData/OutboundSharingTmp") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/tmp/mediaserverd") +(subpath "/private/var/logs/mediaserverd")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/sbin") + (subpath "/usr/local/lib") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/Downloads") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mediaserverd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mediaserverd")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Logs/awd") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${HOME}/Library/Logs") +(literal-prefix "${HOME}/Library/Caches/CoreMotion")) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CoreMotion")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Media/Podcasts") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (subpath-prefix "${HOME}/Library/Caches/com.apple.VideoConference") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Media/Downloads") + (subpath "/private/var/wireless/Library/Logs/awd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (subpath-prefix "${HOME}/Library/VoiceTrigger") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-mediaserverd.log") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/VoiceTrigger") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/mediaserverd") +(literal-prefix "${HOME}/Library/Logs/AirPlay.log") +(literal-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.log") +(subpath-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.logMedia/iTunes_Control/Music") +(subpath-prefix "${HOME}/Library/Caches/CoreMotion/CoreMotion.logMedia/PhotoData/OutboundSharingTmp") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/tmp/mediaserverd") +(subpath "/private/var/logs/mediaserverd")) + (extension "com.apple.mediaserverd.read") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.mediaserverd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.mediaserverd")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.mediaserverd") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mediaserverd"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/CoreMotion"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (vnode-type SOCKET) + (literal-prefix "${FRONT_USER_HOME}/Library/ExternalAccessory/ea"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceSendRight") + (require-any (iokit-user-client-class "AppleUSBHostInterfaceUserClient") +(iokit-user-client-class "IOAccessoryManagerUserClient")) + (require-any (iokit-user-client-class "com_apple_audio_IOBorealisOwlUserClient") +(iokit-user-client-class "AppleAVEUserClient") +(iokit-user-client-class "AppleAVE2UserClient") +(iokit-user-client-class "AppleD5500UserClient") +(iokit-user-client-class "AppleExternalAmpControllerUserClient") +(iokit-user-client-class "AppleH2CamInUserClient") +(iokit-user-client-class "AppleH3CamInUserClient") +(iokit-user-client-class "AppleH4CamInUserClient") +(iokit-user-client-class "AppleH6CamInUserClient") +(iokit-user-client-class "AppleH9CamInUserClient") +(iokit-user-client-class "AppleSPUHIDDriverUserClient") +(iokit-user-client-class "AppleSRSDriverUserClient") +(iokit-user-client-class "AppleVXD375UserClient") +(iokit-user-client-class "AppleVXD390UserClient") +(iokit-user-client-class "AppleVXD393UserClient") +(iokit-user-client-class "AppleVXE380UserClient") +(iokit-user-client-class "IOUSBDeviceInterfaceUserClient") +(iokit-user-client-class "IOTimeSyncDomainUserClient") +(iokit-user-client-class "IOTimeSyncgPTPManagerUserClient") +(iokit-user-client-class "IOTimeSyncClockManagerUserClient") +(iokit-user-client-class "IOTimeSyncUserClient") +(iokit-user-client-class "IOStreamAudioUserClient") +(iokit-user-client-class "IOReportUserClient") +(iokit-user-client-class "IOAudioCodecsUserClient") +(iokit-user-client-class "IOAudio2TransformerUserClient") +(iokit-user-client-class "IOAudio2DeviceUserClient") +(iokit-user-client-class "H3H264VideoEncoderDriverUserClient")) + (iokit-user-client-class "com_apple_driver_FairPlayIOKitUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "IOHIDResourceDeviceUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOHIDLibUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "shm_pcm_audio_sco_write") +(ipc-posix-name "shm_pcm_audio_sco_read")) + (require-any (ipc-posix-name "shm_pcm_audio_acl") +(ipc-posix-name "com.apple.audio.abl.")) + (ipc-posix-name-regex #"^shm_notif[.][^.]+[.][RW]$") + (ipc-posix-name-regex #"^[0-9A-F][0-9A-F]:+[0-9A-F][0-9A-F]-tacl$") + (ipc-posix-name-regex #"^AppleABL[.]." #"^AppleABL[.].+") + (ipc-posix-name-regex #"^AppleAURemoteIO[.]." #"^AppleAURemoteIO[.].+") + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-")) + (ipc-posix-name-regex #"^AppleAudioQueue[.]." #"^AppleAudioQueue[.].+")) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.springboard.processinvalidation") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.homed.xpc") +(global-name "com.apple.iap2d.distributednotification.server") +(global-name "com.apple.iapd.distributednotification.server") +(global-name "com.apple.iaptransportd.xpc")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.WirelessCoexManager") + (require-any (global-name "com.apple.NetworkLinkConditioner") +(global-name "com.apple.airplay.receiver.controller") +(global-name "com.apple.applecamerad") +(global-name "com.apple.audio.AUPBRegistrar") +(global-name "com.apple.b184_mcu_commd") +(global-name "com.apple.b184_monitord") +(global-name "com.apple.carkit.monitoring.service") +(global-name "com.apple.coremedia.virtualdisplayserver") +(global-name "com.apple.filesystems.userfsd") +(global-name "com.apple.internal.mediaserverdtracerd") +(global-name "com.apple.lskdmsed") +(global-name "com.apple.securekeyvaultd")) + (global-name "com.apple.locationd.registration") + (global-name "com.apple.carkit.service") + (global-name "com.apple.idsremoteurlconnectionagent.embedded.auth") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.assertiond.applicationstateconnection") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.iaptransportd.ExternalAccessory.distributednotification.server") +(global-name "com.apple.iap2d.ExternalAccessory.distributednotification.server") +(global-name "com.apple.ExternalAccessory.distributednotification.server")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.timed.xpc") + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemAppPort") + (global-name "com.apple.BTServer.le") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.iTunesStore.daemon") +(global-name "com.apple.iTunesStore.daemon-notifications") +(global-name "com.apple.iTunesStore.daemon.deatchwatch")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "com.apple.networkd") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.mobileactivationd") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.iapd.xpc") +(global-name "com.apple.iap2d.xpc")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.server.bluetooth") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.SharingServices") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.lskdd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (global-name "com.apple.audio.AudioQueueServer") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.coresymbolicationd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.fairplayd.versioned") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (global-name "com.apple.coremedia.") + (global-name "com.apple.midiserver.io") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (local tcp "*:*")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown.sock") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote udp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.settings.bluetooth.audio-route") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.imessage.bag") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.da") + (preference-domain "com.apple.preferences-sounds") + (preference-domain "com.apple.rtcreporting") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.logging") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.voicetrigger") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.carplay") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.assistant") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.CoreMotion") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.VideoProcessing") + (require-any (preference-domain "com.apple.voicetrigger.notbackedup") +(preference-domain "com.apple.audio.puffin") +(preference-domain "com.apple.audio.virtualaudio") +(preference-domain "com.apple.coremedia.bag") +(preference-domain "com.apple.facetime")) + (preference-domain "com.apple.VideoConference") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.conference") + (preference-domain "com.apple.mediaserverd") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.mediaserverd") + (preference-domain "com.apple.airplay") + (preference-domain "com.apple.conference") + (require-any (preference-domain "com.apple.voicetrigger.notbackedup") +(preference-domain "com.apple.audio.puffin") +(preference-domain "com.apple.audio.virtualaudio") +(preference-domain "com.apple.coremedia.bag") +(preference-domain "com.apple.facetime")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.celestial") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.facetime.bag") + (preference-domain "com.apple.voicetrigger") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.imessage.bag") + (extension "com.apple.security.exception.shared-preference.read-write")) +(allow process-exec* + (literal "/usr/sbin/mediaserverd") + (require-all + (require-any (literal "/usr/bin/trace") +(literal "/usr/bin/syslog")) + (debug-mode))) +(allow process-fork + (debug-mode)) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl* + (sysctl-name "kern.min_audio_buffer_usec")) +(allow sysctl-read + (sysctl-name "kern.bootsessionuuid") + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (extension "com.apple.security.exception.sysctl.read-write") + (sysctl-name "sysctl.proc_native") + (sysctl-name "kern.min_audio_buffer_usec") + (sysctl-name "vm.vm_page_free_target") + (sysctl-name "net.routetable.") + (extension "com.apple.security.exception.sysctl.read-only") + (sysctl-name "net.statistics") + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info"))) +(allow system-privilege) +(allow system-suspend-resume) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb.xml new file mode 100644 index 0000000..bfcf301 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mediaserverd.sb.xml @@ -0,0 +1,40 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb new file mode 100644 index 0000000..072de30 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb @@ -0,0 +1,516 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}"))))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-not (subpath "/usr/libexec/Contents")) + (require-any + (literal "/usr/libexec/mobile_house_arrest") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/Library/Preferences/SystemConfiguration/com.apple.afc.DeviceInfo.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/GeoJSON$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/GeoJSON$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.FileCoordination") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.lockdown.host_watcher") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/lockdown/checkin") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobile-house-arrest.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb new file mode 100644 index 0000000..6e50ac9 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb @@ -0,0 +1,542 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (subpath "/System/Library") + (subpath-prefix "${HOME}/Library/mad") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Cookies") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/mad") + (subpath-prefix "${HOME}/Library/Logs/mobileactivationd") + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.mobileactivationd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.mobileactivationd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "ProvInfoIOKitUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.icloud.findmydeviced") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.system.notification_center") + (global-name "com.apple.fairplayd.versioned") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.absd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote tcp "*:443") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:80") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.mobileactivationd") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.stockholm") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.mobileactivationd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileactivationd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb new file mode 100644 index 0000000..94c92f9 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb @@ -0,0 +1,587 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.assets.read") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/private/var/MobileAsset"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal "/private/var/Managed Preferences/mobile/com.apple.MobileAsset.plist") +(literal "/private/var/root/Library/Preferences/com.apple.WebFoundation.plist") +(subpath "/AppleInternal/Library/PreinstalledAssets") +(literal "/usr/libexec/mobileassetd")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/private/var/root/Library/Cookies") +(literal "/private/var/root/Library/Cookies/Cookies.binarycookies") +(literal "/private/var/root/Library/Preferences/com.apple.MobileAsset.plist")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/private/var/MobileAsset") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/mobileassetd") +(subpath-prefix "${HOME}/Library/Caches/mobileassetd")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/Assets") +(literal-prefix "${FRONT_USER_HOME}/Library/VoiceServices") +(subpath-prefix "${FRONT_USER_HOME}/Library/VoiceServices/Assets")) + (subpath-prefix "${HOME}/Library/Cookies") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/private/var/root/Library/Cookies") +(literal "/private/var/root/Library/Cookies/Cookies.binarycookies") +(literal "/private/var/root/Library/Preferences/com.apple.MobileAsset.plist")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath "/private/var/MobileAsset") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+") + (subpath-prefix "${HOME}") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/mobileassetd"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.cache_delete") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.AssetCacheLocatorService") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.networkd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.AssetCacheLocator") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.MobileAsset")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb.xml new file mode 100644 index 0000000..b0d0676 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/mobileassetd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb new file mode 100644 index 0000000..faae357 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb @@ -0,0 +1,662 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath "/System/Library") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Caches") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}"))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/awd/awd-nanomapscd.log") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-any (literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-shm") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-journal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db-wal") +(literal-prefix "${HOME}/Library/Logs/CompanionSync/statistics.db") +(subpath-prefix "${HOME}/Library/Logs/CompanionSync/TransportLogs") +(subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync/TransportLogs")) + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/nms[.]com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync/(nms[.])?com[.]apple[.]private[.]alloy[.]maps[.]sync") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]private[.]alloy[.]maps[.]sync[.]syncCoordinator") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CompanionSync")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Maps$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Maps$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoMaps/" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/PairedSyncServiceRestrictions/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/(NanoMap|PairedSyncServiceRestriction)s/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CompanionSync") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/CompanionSync"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-owner + (require-all + (subpath-prefix "${HOME}") + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/CompanionSync$"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.Maps.SpringBoard") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.routined.registration") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.nanoprefsync") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.Maps.IPC") +(global-name "com.apple.Maps.gsEvents")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.ids") + (preference-domain "com.apple.companionsync") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MapsSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.MapsSupport")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nanomapscd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb new file mode 100644 index 0000000..c143f97 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb @@ -0,0 +1,465 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.MapsSupport") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.MapsSupport")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.MapsSupport") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.MapsSupport")) + (subpath-prefix "${HOME}/Library/Caches/GeoServices") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.MapsSupport") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.MapsSupport"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.locationd.registration") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.routined.registration") + (global-name "com.apple.nanomaps.xpc.GeoServices.Navigation") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.apsd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.carrier") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MapsSupport") + (preference-domain "com.apple.assistant") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.assistant.logging") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.persistentconnection") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/navd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb new file mode 100644 index 0000000..6200aac --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb @@ -0,0 +1,348 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write")) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.diagnosticd") + (global-name "PurpleSystemEventPort") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.system.notification_center") + (require-any + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb.xml new file mode 100644 index 0000000..518eb4e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/network-filter.sb.xml @@ -0,0 +1,30 @@ + + + + + + + + + +]> + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb new file mode 100644 index 0000000..e4a1933 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb @@ -0,0 +1,387 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/dev/tty.stockholm") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (literal "/usr/libexec/nfcd") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/logs/WirelessLibraryLogs") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (require-any (literal-prefix "${HOME}/Library/Logs/AppleSSE.log") +(literal-prefix "${HOME}/Library/Logs/awd/awd-nfcd.log")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-any (subpath "/private/var/logs/MobileLibraryLogs") +(subpath "/private/var/logs/MobileMediaFactoryLogs")) + (debug-mode)) + (require-all + (subpath "/private/var/logs/WirelessLibraryLogs") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd"))) +(allow file-write-data + (literal "/dev/tty.stockholm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "AppleSSEUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleStockholmControlUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.SBUserNotification") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (control-name "com.apple.uart.stockholm") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "nfcd") +(preference-domain "com.apple.nfcd.nfttr")) + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Duet") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.awd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (require-any (preference-domain "nfcd") +(preference-domain "com.apple.nfcd.nfttr")) + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-socket + (socket-domain AF_SYSTEM)) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nfcd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb new file mode 100644 index 0000000..0cbdf9f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb @@ -0,0 +1,96 @@ +(version 1) +(deny default) +(allow file-link) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.pfd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb.xml new file mode 100644 index 0000000..7836567 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nlcd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb new file mode 100644 index 0000000..f57919a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb @@ -0,0 +1,7 @@ +(version 1) +(allow default) +(deny network* + (local ip "*:*")) +(deny network-outbound + (literal "/private/var/tmp/launchd/sock") + (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb.xml new file mode 100644 index 0000000..fa56c88 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nointernet.sb.xml @@ -0,0 +1,20 @@ + + + + + + + + + +]> + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb new file mode 100644 index 0000000..aef77de --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb @@ -0,0 +1,642 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/db/timezone") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-all (require-not (subpath "/private/var/logs/MobileLibraryLogs")) +(require-not (subpath "/private/var/logs/MobileMediaFactoryLogs"))) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/usr/libexec") + (literal "/usr/libexec/nsurlsessiond") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (subpath-prefix "${HOME}/Media/Downloads") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.coremedia")) + (require-any + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/dtracehelper") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (uid 0) + (literal "/private/etc/master.passwd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-all (require-not (subpath "/private/var/logs/MobileLibraryLogs")) +(require-not (subpath "/private/var/logs/MobileMediaFactoryLogs"))) + (require-not (subpath "/private/var/logs/WirelessLibraryLogs")) + (require-any + (subpath-prefix "${HOME}/Media/Downloads") + (require-any (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/Logs/com.apple.nsurlsessiond") +(subpath-prefix "${HOME}/Library/com.apple.nsurlsessiond")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/com[.]apple[.]UserManagedAssets") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/com[.]apple[.]nsurlsessiond") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.nsurlsessiond")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (require-any + (extension "com.apple.nsurlsessiond.readonly") + (require-all + (regex #"^/private/var/mobile/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/euser[0-9]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/[-0-9A-F]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/" #"^/private/var/Users/[^/]+/Library/com[.]apple[.]nsurlsessiond/[^/]+/[^/]+/Uploads/") + (subpath-prefix "${HOME}"))))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.marco") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.coreduetd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.ocspd") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.coremedia.sandboxserver") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.coremedia.assetdownloader") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (global-name "com.apple.networkd") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.symptomsd") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (require-not (global-name "com.apple.CARenderServer")) + (require-any + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.mt") + (preference-domain "com.apple.Duet") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nsurlsessiond") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.nsurlsessiond")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlsessiond.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb new file mode 100644 index 0000000..0797db6 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb @@ -0,0 +1,429 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${HOME}/Applications") +(literal-prefix "${HOME}/Containers")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath "/usr/lib") + (subpath "/private/var/containers") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.nsurlstorage.extension-cache") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/libexec") + (literal-prefix "${HOME}") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.trustd") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.nsurlstoraged") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.nsurlstoraged")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/nsurlstoraged.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb new file mode 100644 index 0000000..1d211e2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb @@ -0,0 +1,397 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/usr/libexec/online-auth-agent") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/private/var/containers/Bundle") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/MobileDevice") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/private/var/db/MobileIdentityData") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/MobileDevice") + (subpath "/private/var/db/MobileIdentityData") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "IOAESAcceleratorUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.misagent") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.online-auth-agent.xpc") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote ip "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/online-auth-agent.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb new file mode 100644 index 0000000..104ba7e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb @@ -0,0 +1,580 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (subpath "/System/Library") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (require-any (literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-journal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-shm") +(literal-prefix "${HOME}/Library/com.apple.itunesstored/kvs.sqlitedb-wal") +(literal-prefix "${HOME}/Library/com.apple.itunesstored")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${HOME}/Library/CoreDuet") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.parsecd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.parsecd"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${FRONT_USER_HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.locationd.registration") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.DataDetectorsSourceAccess") +(global-name "com.apple.dprivacyd")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.networkserviceproxy") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.nehelper") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.Preferences") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.parsecd") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.parsecd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/parsecd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb new file mode 100644 index 0000000..d0bb29f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb @@ -0,0 +1,974 @@ +(version 1) +(deny default) +(allow distributed-notification-post) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.passd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.passd") +(subpath-prefix "${HOME}/Library/Passes") +(subpath-prefix "${HOME}/Library/Caches/PassKit")) + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Fonts") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/preferences/com.apple.networkd.plist") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Mobile Documents") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.passd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.passd") +(subpath-prefix "${HOME}/Library/Passes") +(subpath-prefix "${HOME}/Library/Caches/PassKit")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.passd") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${HOME}/Library/Caches/com.apple.pep.configuration.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.stockholm.plist")) + (require-any + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))))) +(allow iokit-set-properties + (iokit-property "reportStatusMessages")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.CoreAuthentication.daemon") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.biometrickitd") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.seld.tsmmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.nfcd") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.seld") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.networkd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-all + (require-not (global-name "com.apple.pluginkit.pkd")) + (require-any + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (require-any (global-name "com.apple.NPKCompanionAgent.Server") +(global-name "com.apple.passes.usage") +(global-name "com.apple.springboard.carditemscontroller") +(global-name "com.apple.AdSheetPhone.analytics")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.fig.movie") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.icloud.findmydeviced") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cloudd") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.librariand") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.locationd.spi") + (global-name "com.apple.SharingServices") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.marco") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.FSEvents") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.networkd") + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (remote ip "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/mDNSResponder") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (remote tcp "*:*") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (require-any (control-name "com.apple.network.statistics") +(control-name "com.apple.netsrc")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.conference") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.biometrickitd") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.LocalAuthentication") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.marco") + (preference-domain "com.apple.ConfigServer") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.Passbook") +(preference-domain "com.apple.PassKit") +(preference-domain "com.apple.passd")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.AdLib") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.purplebuddy") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.stockholm") + (preference-domain "kCFPreferencesAnyApplication") + (require-any (preference-domain "com.apple.Passbook") +(preference-domain "com.apple.PassKit") +(preference-domain "com.apple.passd"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb.xml new file mode 100644 index 0000000..eb34181 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/passd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb new file mode 100644 index 0000000..ffc385c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb @@ -0,0 +1,506 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (require-any (literal "/usr/local/bin") +(literal "/usr/local/bin/prtool")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Personas") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Personas") + (subpath-prefix "${HOME}/Library/Caches/com.apple.personad") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.personad")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.marco") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/personad.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb new file mode 100644 index 0000000..f18dc42 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb @@ -0,0 +1,176 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/pfm") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/usr/libexec/pfd") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/dev/pfm") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/pfm") + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow iokit-get-properties) +(allow ipc-posix-shm-read-data + (ipc-posix-name "apple.shm.notification_center")) +(allow mach-cross-domain-lookup) +(allow process-info-codesignature) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb.xml new file mode 100644 index 0000000..4d39a5c --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/pfd.sb.xml @@ -0,0 +1,25 @@ + + + + + + + + + +]> + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb new file mode 100644 index 0000000..8af1fb0 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb @@ -0,0 +1,674 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/CPLAssets") +(subpath-prefix "${HOME}/Media/PhotoData/Sync") +(subpath-prefix "${HOME}/Media/PhotoData/Mutations")) + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/PhotoData") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.photoanalysisd") + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.photoanalysisd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "IOSurfaceRootUserClient") + (require-any (iokit-user-client-class "AGXCommandQueue") +(iokit-user-client-class "AGXDevice") +(iokit-user-client-class "AGXGLContext") +(iokit-user-client-class "AGXSharedUserClient")) + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient") + (require-any (iokit-user-client-class "AppleJPEGDriverUserClient") +(iokit-user-client-class "IOSurfaceAcceleratorClient")) + (require-any (iokit-user-client-class "IOAccelContext") +(iokit-user-client-class "IOAccelContext2") +(iokit-user-client-class "IOAccelDevice") +(iokit-user-client-class "IOAccelDevice2") +(iokit-user-client-class "IOAccelSharedUserClient") +(iokit-user-client-class "IOAccelSharedUserClient2") +(iokit-user-client-class "IOAccelSubmitter2")) + (iokit-user-client-class "IOMobileFramebufferUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.networkd") + (global-name "com.apple.routined.registration") + (global-name "com.apple.calaccessd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.ABDatabaseDoctor") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.photoanalysisd") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.photoanalysisd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/photoanalysisd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb new file mode 100644 index 0000000..9f5945b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb @@ -0,0 +1,590 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}"))) +(allow file-read* + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Preferences") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (extension "com.apple.security.exception.iokit-user-client-class") + (require-all + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (require-entitlement "com.apple.private.amfi.can-load-cdhash"))) +(allow iokit-get-properties + (iokit-property "IORegistryEntryPropertyKeys")) +(allow ipc-posix-sem* + (extension "com.apple.sandbox.application-group")) +(allow ipc-posix-sem-open + (ipc-posix-name "containermanagerd.fb_check")) +(allow ipc-posix-shm* + (require-any (ipc-posix-name "stack-logs") +(ipc-posix-name "OA-") +(ipc-posix-name "/FSM-"))) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs.")) + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow ipc-posix-shm-write-data + (ipc-posix-name-regex #"^gdt-[0-9A-Za-z]+-c$" #"^gdt-[0-9A-Za-z]+-s$")) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (extension "com.apple.sandbox.application-group") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (extension "com.apple.sandbox.application-group") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network-inbound + (require-all + (extension "com.apple.sandbox.application-group") + (regex #"^/private/var/mobile/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/euser[0-9]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/[-0-9A-F]+/Containers/Shared/AppGroup/[^/]+/" #"^/private/var/Users/[^/]+/Containers/Shared/AppGroup/[^/]+/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb.xml new file mode 100644 index 0000000..a98dfe7 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/playground-devtools.sb.xml @@ -0,0 +1,24 @@ + + + + + + + + + +]> + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb new file mode 100644 index 0000000..02caa40 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb @@ -0,0 +1,215 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/powerlog") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/BatteryLife")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${PROCESS_TEMP_DIR}/powerlog") +(subpath-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/BatteryLife")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/powerlogd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb new file mode 100644 index 0000000..d80b9f3 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb @@ -0,0 +1,516 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${HOME}/Library/com.apple.printd") +(subpath "/private/var/run/printd")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/System/Library") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}/Library/com.apple.printd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var/run/printd") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (literal-prefix "${HOME}/Library/Preferences") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/com.apple.printd") +(subpath "/private/var/run/printd")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Caches/com.apple.printd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.printd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.notificationcenter.widgetcontrollerconnection") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.nehelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local tcp "*:*")) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.printd") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.printd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/printd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb new file mode 100644 index 0000000..36dde98 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb @@ -0,0 +1,253 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/private/etc/hosts") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (regex #"^/private/var/[-0-9A-F]+" #"^/private/var/mobile" #"^/private/var/euser[0-9]+" #"^/private/var/Users/[^/]+") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Media") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Logs/ptpd.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/Photos") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (literal-prefix "${HOME}/Library/Logs/CrashReporter")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.ImageCaptureFramework") + (preference-domain "com.apple.mobileslideshow")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb.xml new file mode 100644 index 0000000..bd4ad12 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/ptpd.sb.xml @@ -0,0 +1,41 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb new file mode 100644 index 0000000..3d4ad1e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb @@ -0,0 +1,1150 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension-class "com.apple.quicklook.readonly") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.quicklook.readonly") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets"))) +(allow file-read* + (literal-prefix "${HOME}/Library/Caches/com.apple.itunesstored/url-resolution.plist") + (subpath "/System/Library") + (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.lsd.iconscache") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/private/var/preferences/SystemConfiguration/com.apple.radios.plist") + (subpath "/usr/share") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (literal "/private/var/preferences/SystemConfiguration/com.apple.mobilegestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal-prefix "${HOME}/Library/Caches/DateFormats.plist") + (extension "com.apple.quicklook.readonly") + (literal "/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist") + (subpath "/AppleInternal/Library/Frameworks/TypologyRecording.framework") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (require-any (subpath-prefix "${HOME}/Library/Dictionaries") +(subpath-prefix "${HOME}/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice") +(subpath-prefix "${HOME}/Library/VoiceServices/Assets") +(subpath-prefix "${HOME}/Library/Caches/com.apple.keyboards") +(literal-prefix "${HOME}/Library/") +(literal "/private/var/preferences/SystemConfiguration/com.apple.sinaweibo.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.twitter.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.facebook.plist") +(literal "/private/var/preferences/SystemConfiguration/com.apple.linkedin.plist") +(subpath "/Library/Dictionaries") +(literal "/")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.UIStatusBar") + (literal "/com.apple.xpc.launchd.bootstrap.plist") + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (require-any (subpath-prefix "${HOME}/Library/OnDemandResources/AssetPacks") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.ondemandresources/Library/AssetPacks")) + (extension "com.apple.odr-assets")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (extension "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/[.]GlobalPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices") + (extension "com.apple.app-sandbox.read-write") + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal "/private/var/run/printd") + (vnode-type SYMLINK) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/PPTDevice") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (require-not (literal-prefix "${HOME}/Library/Preferences/com.apple.springboard.plist")) + (require-not (literal-prefix "${HOME}/Library/Caches/DateFormats.plist")) + (require-any + (extension "com.apple.app-sandbox.read-write") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-journal") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-shm") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb-wal")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")))) + (require-all + (require-any (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb") +(literal-prefix "${HOME}/Media/iTunes_Control/iTunes")) + (extension "com.apple.tcc.kTCCServiceMediaLibrary")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches/com.apple.DictionaryServices"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.revisiond") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.sharingd.nsxpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.KeyboardServices.TextReplacementService") +(global-name "com.apple.UIKit.pasteboardd") +(global-name "com.apple.UIKit.KeyboardManagement") +(global-name "com.apple.pasteboard.pasted") +(global-name "com.apple.dictationd.recognition") +(global-name "com.apple.airplaydiagnostics.server") +(global-name "com.apple.accessibility.gax.backboard") +(global-name "com.apple.ondemandd.client") +(global-name "com.apple.voiceservices.keepalive") +(global-name "com.apple.TextInput.preferences") +(global-name "com.apple.TextInput.emoji") +(global-name "com.apple.TextInput.image-cache-server") +(global-name "com.apple.TextInput.rdt") +(global-name "com.apple.TextInput.shortcuts") +(global-name "com.apple.TextInput") +(global-name "com.apple.siri.context.service") +(global-name "UIASTNotificationCenter") +(global-name "ScripterServer")) + (global-name "com.apple.voiceservices.tts") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.mobilemail.services.xpc") + (local-name "com.apple.iphone.axserver") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.bird") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.UIKit.statusbarserver") + (require-any (global-name "com.apple.audio.hapticd") +(global-name "com.apple.backboard.animation-fence-arbiter")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.assistant.analytics") + (global-name "PurpleSystemAppPort") + (global-name "com.apple.securityd") + (global-name "com.apple.medialibraryd.xpc") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.mediaserverd") + (global-name-regex #"^com[.]apple[.]uikit[.]viewservice[.].+") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (local-name "com.apple.assistant.contextprovider.") + (require-any (global-name "com.apple.uikit.GestureServer") +(global-name "com.apple.assertiond.processinfoservice") +(global-name "com.apple.UIKit.KeyboardManagement.hosted") +(global-name "com.apple.backboard.TouchDeliveryPolicyServer") +(global-name "com.apple.backboard.hid.focus") +(global-name "com.apple.TextInput.lexicon-server") +(global-name "com.apple.frontboard.workspace")) + (global-name "com.apple.assertiond.expiration") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.iphone.axserver-systemwide") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.calaccessd") + (global-name "com.apple.sharingd") + (global-name "com.apple.backboard.hid.services") + (require-any (global-name "com.apple.audio.AURemoteIOServer") +(global-name "com.apple.assistant.dictation") +(global-name "com.apple.accessibility.mediaaccessibilityd")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.librariand") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.marco") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.fig.movie") + (global-name "com.apple.audio.AudioQueueServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.callkit.callcontrollerhost") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (require-any (global-name "com.apple.cvmsServ") +(global-name "com.apple.gpumemd.source")) + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.ProgressReporting") + (require-any (global-name "com.apple.coremedia.mutablecomposition") +(global-name "com.apple.coremedia.mutablecomposition.xpc")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.iohideventsystem") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (literal "/private/var/run/printd") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.homesharing") +(preference-domain "com.apple.medialibrary")) + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.telephonyutilities.dialassist") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.da") + (require-any (preference-domain "com.apple.mediaaccessibility") +(preference-domain "com.apple.coreanimation") +(preference-domain "com.apple.preferences.sounds")) + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.keyboard") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.EmojiPreferences") + (preference-domain "com.apple.avfoundation") + (require-any (preference-domain "com.apple.voiceservices") +(preference-domain "com.apple.MapKit.internal") +(preference-domain "com.apple.WebUI") +(preference-domain "com.apple.InputModePreferences") +(preference-domain "com.apple.lookup.shared") +(preference-domain "com.apple.SpeakSelection")) + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.Sharing") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.Preferences") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.assistant.backedup") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.assistant.support") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.quicklook.quicklookd") + (preference-domain "com.apple.AppSupport") + (require-any (preference-domain "com.apple.opengl") +(preference-domain "com.apple.Metal")) + (preference-domain "com.apple.VoiceOverTouch") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.mt") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.iapd") + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.CoreMotion") + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos"))) +(allow user-preference-write + (preference-domain "com.apple.quicklook.quicklookd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/quicklookd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb new file mode 100644 index 0000000..3ce5c6f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb @@ -0,0 +1,123 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/private/etc/master.passwd") + (literal "/dev/sha1_0") + (subpath "/private/var/run/racoon") + (literal "/dev/dtracehelper") + (require-any (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") +(subpath "/private/etc/racoon")) + (literal "/dev/aes_0")) +(allow file-link) +(allow file-map-executable) +(allow file-read* + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal "/private/var/log/racoon.log") + (require-any (literal "/Library/Managed Preferences") +(subpath "/private/var/root")) + (literal "/private/etc/master.passwd") + (require-any (literal "/private/var/preferences/SystemConfiguration/com.apple.ipsec.plist") +(subpath "/private/etc/racoon")) + (subpath "/private/var/run/racoon") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal "/Library/Managed Preferences/mobile") +(subpath "/private/var/preferences")) + (subpath "/usr/share") + (subpath "/private/var/db/timezone") + (subpath "/private/var/Managed Preferences/mobile") + (literal "/dev/dtracehelper") + (literal "/private/var/db/icu") + (literal "/private/var/run/racoon.pid") + (literal "/private/var/run/racoon.sock") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/Library/Preferences") + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/private/var/db/dyld") + (subpath "/usr/share"))) + (require-all + (file-mode #o0004) + (require-any + (subpath "/System") + (subpath "/usr/lib") + (subpath "/usr/sbin") + (subpath "/usr/share")))) +(allow file-read-metadata + (require-any (literal "/etc") +(literal "/tmp") +(literal "/private/etc/localtime") +(literal "/var"))) +(allow file-write* + (literal "/private/var/run/racoon.sock") + (literal "/private/var/run/racoon.pid") + (literal "/private/var/log/racoon.log") + (require-all + (literal "/cores/") + (require-not (file-mode #o0000)))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/sha1_0") + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))) +(allow iokit-open + (iokit-user-client-class "RootDomainUserClient")) +(allow iokit-get-properties) +(allow ipc-posix-shm-read* + (require-any (ipc-posix-name "apple.shm.notification_center") +(ipc-posix-name "apple.cfprefs."))) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.DirectoryService.libinfo_v1") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.aggregated") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.nehelper") + (global-name "com.apple.ocspd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.system.notification_center") + (local-name "com.apple.cfprefsd.agent")) +(allow network* + (remote udp "*:*") + (literal "/private/var/run/racoon.sock") + (local udp "*:4500") + (local udp "*:500")) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")) + (require-any + (literal "/private/var/run/syslog") + (literal "/private/var/run/asl_input") + (control-name "com.apple.net.ipsec_control")))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow sysctl*) +(allow sysctl-read) +(allow sysctl-write) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb.xml new file mode 100644 index 0000000..4668b57 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/racoon.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb new file mode 100644 index 0000000..9beda8e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb @@ -0,0 +1,550 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.replayd.read-only") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath-prefix "${HOME}/Library/ReplayKit")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/usr/libexec") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/ReplayKit") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/System/Library") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/Developer") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (subpath "/private/var/containers/Bundle/Application") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/ReplayKit") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "IOSurfaceRootUserClient") + (iokit-user-client-class "IOMobileFramebufferUserClient") + (iokit-user-client-class "IOSurfaceSendRight")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.coremedia.audiodeviceclock") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.backboard.display.services") + (global-name "com.apple.fig.movie") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.coremedia.virtualdisplaysession") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.audio.AudioQueueServer") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.avfoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/replayd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb new file mode 100644 index 0000000..861676b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb @@ -0,0 +1,259 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.webinspector") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.suggestions") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/reversetemplated.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb new file mode 100644 index 0000000..ba631af --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb @@ -0,0 +1,391 @@ +(version 1) +(deny default) +(allow file-ioctl + (literal "/dev/fsevents") + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (require-any (extension-class "com.apple.revisiond.revision") +(extension-class "com.apple.revisiond.staging")) + (require-any + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-link) +(allow file-read* + (subpath "/private/var/db/timezone") + (subpath "/Developer") + (subpath "/usr/share") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath "/System/Library") + (literal "/dev/ptmx") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/fsevents") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (vnode-type CHARACTER-DEVICE) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/usr/lib") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (extension "com.apple.sandbox.executable") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/log/com.apple.revisiond") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/mobile/[.]DocumentRevisions-V100/" #"^/private/var/mobile/[.]DocumentRevisions-V100$" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/mobile/[.]DocumentRevisions-V100-bad-[0-9]+$" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/euser[0-9]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/[-0-9A-F]+/[.]DocumentRevisions-V100-bad-[0-9]*$" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*/" #"^/private/var/Users/[^/]+/[.]DocumentRevisions-V100-bad-[0-9]*$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/[.]DocumentRevisions-V100/" #"^/private/var/[.]DocumentRevisions-V100$" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+/" #"^/private/var/[.]DocumentRevisions-V100-bad-[0-9]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.FSEvents") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.revisiond") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.CoreServices.coreservicesd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-sched) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb.xml new file mode 100644 index 0000000..b0d0676 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/revisiond.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb new file mode 100644 index 0000000..9f62f1b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb @@ -0,0 +1,696 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/System") + (subpath "/Library/Audio/Plug-Ins") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath-prefix "${HOME}/Library/Assets") + (subpath "/private/var/containers/Bundle") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/CoreDuet") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-journal") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-shm") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal/cache.db-wal") +(literal-prefix "${HOME}/Library/DuetKnowledgeCollector/Internal") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_coreduetd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_duetexpertd") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/ExcResource_routined") +(literal-prefix "${HOME}/Library/") +(literal "/usr/libexec/routined")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.routined") +(literal-prefix "${HOME}/Library/Logs/coreduetd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") +(literal-prefix "${HOME}/Library/Logs/duetexpertd_") +(literal-prefix "${HOME}/Library/Logs/routined_") +(literal-prefix "${HOME}/Library/Logs/") +(literal "/private/var/Managed Preferences/mobile/com.apple.routined.plist")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/AppleInternal/Library") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (subpath "/private/var/containers/Data/System/com.apple.geod") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/PPTDevice") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Caches") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Logs/awd/awd-routined.log") +(subpath-prefix "${HOME}/Library/Logs/com.apple.routined") +(literal-prefix "${HOME}/Library/Logs/coreduetd_") +(literal-prefix "${HOME}/Library/Logs/CrashReporter/CoreRoutineDiagnosticFiles") +(literal-prefix "${HOME}/Library/Logs/duetexpertd_") +(literal-prefix "${HOME}/Library/Logs/routined_") +(literal-prefix "${HOME}/Library/Logs/") +(literal "/private/var/Managed Preferences/mobile/com.apple.routined.plist")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.routined") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.routined")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny")))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.pluginkit.pkd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.carkit.service") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.server.bluetooth") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.CARenderServer") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.awdd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.Maps.mapspushd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.coreduetd.knowledge") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.wifi.manager") + (global-name "com.apple.calaccessd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.managedconfiguration.profiled") + (require-any (global-name "com.apple.coreduetd.context") +(global-name "com.apple.coreduetd.knowledgebase")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (require-any (global-name "com.apple.locationd.routine") +(global-name "com.apple.navigationListener") +(global-name "com.apple.passd.usage")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.corerecents.recentsd") + (global-name "com.apple.mobileassetd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.trustd") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.conference") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.routined") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.mediaremote") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.stockholm") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.routined")) +(allow process-exec* + (literal "/usr/bin/ditto")) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) +(allow system-socket) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb.xml new file mode 100644 index 0000000..6a34699 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/routined.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb new file mode 100644 index 0000000..50b197a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb @@ -0,0 +1,348 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/private/var/Keychains") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath "/private/var/Keychains") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.SharedWebCredentials") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.security.cloudkeychainproxy3") +(global-name "com.apple.security.keychainsyncingoveridsproxy") +(global-name "com.apple.security.swcagent")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/securityd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb new file mode 100644 index 0000000..5a38ad4 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb @@ -0,0 +1,587 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.seld") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.seld") +(literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist") +(literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (literal "/usr/libexec/seld") +(subpath "/System/Library/StockholmPlugins")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Logs/CrashReporter") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.seld") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.seld") +(literal-prefix "${HOME}/Library/Caches/com.apple.seld.seinfo.plist") +(literal-prefix "${HOME}/Library/Logs/awd/awd-seld.log")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Caches/com.apple.seld") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs/NearField") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.seld")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter/DiagnosticLogs")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/CrashReporter")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (iokit-user-client-class "AppleCredentialManagerUserClient") + (iokit-user-client-class "RootDomainUserClient") + (iokit-user-client-class "AppleSSEUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.nfcd.hwmanager") + (global-name "com.apple.awdd") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.networkd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.nehelper") + (global-name "com.apple.nfcd") + (global-name "com.apple.apsd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "com.apple.securityd") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-register + (global-name "com.apple.seld.aps") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.logging") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.seld") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.stockholm.awd") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.stockholm") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.passbook") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.seld") + (preference-domain "com.apple.stockholm") + (preference-domain "com.apple.stockholm.tsmreg") + (preference-domain "com.apple.stockholm.awd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/seld.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb new file mode 100644 index 0000000..c514f9a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb @@ -0,0 +1,1046 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Media/PhotoStreamsData")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sharing.airdrop.readonly")) + (require-all + (subpath-prefix "${HOME}/Media/DCIM") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories"))) + (require-all + (subpath-prefix "${HOME}/Media/Memories") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.app-sandbox.read-write")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (subpath-prefix "${HOME}/Media/PhotoData") + (require-any + (extension-class "com.apple.mediaserverd.read-write") + (extension-class "com.apple.mediaserverd.read"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath-prefix "${HOME}/Media/DCIM") + (subpath-prefix "${HOME}/Media/Memories"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (extension "com.apple.librarian.ubiquity-container") + (extension-class "com.apple.mediaserverd.read")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.app-sandbox.read-write"))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Library/Sharing") +(subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd")) + (subpath "/usr/lib") + (literal "/private/var") + (extension "com.apple.sharing.airdrop.readonly") + (literal "/usr/libexec") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (subpath "/AppleInternal/Applications/Sharing.app") + (subpath "/private/var/db/timezone") + (literal "/private") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (extension "com.apple.sandbox.executable") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Media/Memories") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath "/System/Library") + (subpath-prefix "${HOME}/Media/PhotoStreamsData") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/CloudDocs/session/r") + (vnode-type REGULAR-FILE) + (extension "com.apple.clouddocs.version")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/Fonts") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.sharingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.sharingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-sharingd.log")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/Application Support/Ubiquity/genstore") + (extension "com.apple.librarian.ubiquity-revision")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}"))) +(allow file-read-data + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-read-metadata + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library") + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Mobile Documents") + (literal-prefix "${HOME}/Downloads") + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Media/PhotoData") + (subpath-prefix "${HOME}/Media/Memories") + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Library/Logs/awd") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/PPTDevice") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Downloads")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-xattr + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/PerUID") +(subpath "/private/var/.DocumentRevisions-V100/PerUID")) + (extension "com.apple.revisiond.revision"))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Media/Photos") +(subpath-prefix "${HOME}/Media/Debug")) + (subpath-prefix "${HOME}/Media/Recordings") + (subpath-prefix "${HOME}/Media/PhotoData") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Notes") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/Memories") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Media/DCIM") + (require-any (subpath-prefix "${HOME}/Library/Sharing") +(subpath-prefix "${HOME}/Library/Logs/com.apple.sharingd")) + (subpath-prefix "${HOME}/Media/MediaAnalysis") + (require-all + (vnode-type REGULAR-FILE) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (vnode-type SYMLINK) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.sharingd") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.sharingd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.sharingd") +(literal-prefix "${HOME}/Library/Logs/awd/awd-sharingd.log")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/com[.]apple[.]sharing/") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.sharingd")))) + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (regex #"^/private/var/mobile/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/euser[0-9]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/[-0-9A-F]+/Library/Caches/com.apple.notes..+.lock$" #"^/private/var/Users/[^/]+/Library/Caches/com.apple.notes..+.lock$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (require-any (subpath-prefix "${FRONT_USER_HOME}/.DocumentRevisions-V100/staging") +(subpath "/private/var/.DocumentRevisions-V100/staging")) + (extension "com.apple.revisiond.staging"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Downloads")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Logs/awd")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${HOME}/Media/MediaAnalysis") +(literal-prefix "${HOME}/Media/Memories")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-flags + (literal-prefix "${HOME}/Downloads")) +(allow file-write-mode + (literal-prefix "${HOME}/Downloads") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-unlink + (require-all + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices") + (extension "com.apple.identityservices.deliver"))) +(allow file-write-xattr + (literal-prefix "${HOME}/Downloads") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.revisiond") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.coreservices.appleid.authentication") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.server.bluetooth") + (global-name "com.apple.fig.movie") + (global-name "com.apple.nehelper") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.studentd") + (global-name "com.apple.usymptomsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.MobileInternetSharing") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.cloudd") + (require-any (global-name "com.apple.passd.assertions") +(global-name "com.apple.passd.library") +(global-name "com.apple.NPKCompanionAgent.library")) + (global-name "com.apple.quicklook.ThumbnailsAgent") + (global-name "com.apple.awdd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ak.anisette.xpc") + (global-name "com.apple.bird") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.mobileassetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller") + (require-any (global-name "com.apple.bird.token") +(global-name "com.apple.FileProvider")) + (global-name "com.apple.apsd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.bulletinboard.settingsconnection") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.MediaRemote.daemon") +(global-name "com.apple.MediaRemote.isrunning") +(global-name "com.apple.MediaRemote.nowplayingserver")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.wifi.manager") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.calaccessd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (require-any (global-name "com.apple.coreduetd.context") +(global-name "com.apple.coreduetd.knowledgebase")) + (global-name "com.apple.librariand") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.networkd") + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (global-name "com.apple.voicememod.xpc") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.lsd.modifydb") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.absd") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.iokit.powerdxpc") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.backboard.hid.services") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-inbound + (local tcp "*:*") + (local udp "*:*") + (require-all + (subpath-prefix "${HOME}/Library/Mobile Documents") + (require-any + (extension "com.apple.librarian.ubiquity-container") + (require-entitlement "com.apple.private.librarian.container-proxy"))) + (require-all + (extension "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Mobile Documents"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileAsset") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.conference") + (require-any (preference-domain "com.apple.eventkit") +(preference-domain "com.apple.coreduet.logging") +(preference-domain "com.apple.wirelessproxd.debug")) + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.MultitouchSupport") + (preference-domain "com.apple.ids") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.mediaremote") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (preference-domain "com.apple.mobilenotes") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.DataMigration") + (preference-domain "com.apple.sharingd") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow user-preference-write + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.sharingd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/sharingd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb new file mode 100644 index 0000000..1ef6f97 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb @@ -0,0 +1,959 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (require-all + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.tcc.kTCCServicePhotos")))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc"))) +(allow file-read* + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${HOME}/Media/Vibrations/UserGeneratedVibrationPatterns.plist") +(subpath "/Library/Ringtones")) + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (require-any (subpath-prefix "${HOME}/Media/iTunes_Control/Ringtones") +(subpath-prefix "${HOME}/Media/Purchases")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (subpath-prefix "${HOME}/Library/Social") +(subpath-prefix "${HOME}/Library/Twitter") +(subpath-prefix "${HOME}/Library/Weibo")) + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/Developer") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/private/var/preferences/com.apple.security.plist") + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/Checkpoint.plist") + (subpath "/System/Library") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/Media/iTunes_Control/iTunes/Ringtones.plist") + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Metadata") +(subpath-prefix "${HOME}/Media/PhotoData/Thumbnails")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.tcc.kTCCServicePhotos") + (literal-prefix "${HOME}/Media/PhotoData/Photos.sqlite") + (process-attribute 4)) + (require-all + (require-any (subpath-prefix "${HOME}/Media/PhotoData/Sync/FaceAlbumThumbnails") +(literal-prefix "${HOME}/Media/PhotoData/syncInfo.plist")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-all (require-not (subpath-prefix "${HOME}/Library/FairPlay")) +(require-not (literal "/usr/sbin/fairplayd"))) + (require-not (subpath-prefix "${HOME}/Media")) + (require-any + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath-prefix "${HOME}/Library/Cookies") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com[.]apple[.]ToneLibrary$") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${HOME}/Media") + (extension "com.apple.avasset.read-only") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/NanoPreferencesSync/NanoDomains/com.apple.nanoprefsyncd$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc")) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Preferences") + (subpath-prefix "${HOME}/Library/Cookies") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (literal-prefix "${HOME}") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Caches/com.apple.tencentweibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.twitter.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.flickr.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.facebook.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.weibo.xpc") +(subpath-prefix "${HOME}/Library/Caches/com.apple.vimeo.xpc")) + (require-any (subpath-prefix "${HOME}/Library/Social") +(subpath-prefix "${HOME}/Library/Twitter") +(subpath-prefix "${HOME}/Library/Weibo")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc")) + (require-all + (require-not (subpath-prefix "${HOME}/Media")) + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Cookies") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.tencentweibo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.flickr.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.vimeo.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.weibo.xpc")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.facebook.xpc")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.twitter.xpc"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.coremedia.endpoint.xpc") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.PowerManagement.control") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (global-name "com.apple.usymptomsd") + (global-name "com.apple.springboard.services") + (global-name "com.apple.itunescloudd.xpc") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.nanoprefsync") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.accountsd.oauthsigner") + (global-name "com.apple.cmfsyncagent.embedded.auth") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.PersistentURLTranslator.Gatekeeper") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.audio.SystemSoundServer-iOS") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.networkd") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.mobilecheckpoint.checkpointd") + (global-name "com.apple.nehelper") + (global-name "com.apple.vibrationmanagerd") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.assetsd.changehub") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.symptomsd") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.itunescloudd.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.admin") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.fig.movie") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.coremedia.sandboxserver") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.mediaserverd") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.audio.AudioSession") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.backgroundappservices") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.coremedia.figcpecryptor") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.pegasus") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (global-name "com.apple.coremedia.endpoint.xpc") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.WebFoundation") + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.mobileslideshow") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.nanoprefsyncd") + (preference-domain "com.apple.twitterd") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.camera") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.springboard") + (preference-domain "com.apple.coremedia") + (require-any (preference-domain "com.apple.weibo.xpc") +(preference-domain "com.apple.vimeo.xpc") +(preference-domain "com.apple.twitter.xpc") +(preference-domain "com.apple.tencentweibo.xpc") +(preference-domain "com.apple.flickr.xpc") +(preference-domain "com.apple.facebook.xpc")) + (preference-domain "com.apple.itunesstored") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.coreaudio") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.mobileipod") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.itunesstored") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coreaudio") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.coremedia") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.avfoundation") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.corevideo") + (extension "com.apple.tcc.kTCCServicePhotos")) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.weibo.xpc") +(preference-domain "com.apple.vimeo.xpc") +(preference-domain "com.apple.twitter.xpc") +(preference-domain "com.apple.tencentweibo.xpc") +(preference-domain "com.apple.flickr.xpc") +(preference-domain "com.apple.facebook.xpc")) + (preference-domain "com.apple.twitterd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/social-services.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb new file mode 100644 index 0000000..6e16e7d --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb @@ -0,0 +1,382 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (literal "/private/var/preferences/com.apple.security.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (require-any (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") +(subpath "/private/var/MobileSoftwareUpdate") +(subpath "/private/var/db/UpdateMetrics")) + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}/MobileSoftwareUpdate") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/MobileSoftwareUpdate")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal-prefix "${HOME}/Library/Logs/CrashReporter/OTAUpdate-") + (require-any (literal-prefix "${HOME}/MobileSoftwareUpdate/restore.log") +(subpath "/private/var/MobileSoftwareUpdate") +(subpath "/private/var/db/UpdateMetrics")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/MobileSoftwareUpdate"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleMobileFileIntegrityUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) +(allow iokit-set-properties + (iokit-property "IONVRAM-DELETE-PROPERTY")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.symptomsd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.aggregated") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.commcenter.cupolicy.xpc") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.nehelper") + (global-name "com.apple.diagnosticd") + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.networkd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.trustd") + (global-name "com.apple.nsurlsessiond") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client") + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.MobileSoftwareUpdate") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.MobileAsset") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/softwareupdated.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb new file mode 100644 index 0000000..0d4813f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb @@ -0,0 +1,416 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.StreamingUnzipService") + (subpath-prefix "${HOME}/Media")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/containers/Bundle") + (literal "/dev/aes_0") + (literal "/usr/libexec/streaming_zip_conduit") + (literal "/private/var/preferences/com.apple.security.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-data + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media"))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-create + (require-all + (subpath-prefix "${HOME}/Media") + (require-any + (vnode-type REGULAR-FILE) + (vnode-type DIRECTORY)))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-unlink + (require-all + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Media")) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Media"))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.springboard.blockableservices") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lockdown.host_watcher") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.usernotifications.usernotificationservice") + (global-name "com.apple.ProgressReporting") + (global-name "com.apple.mobile.installd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.lsd.modifydb") + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/streaming_zip_conduit.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb new file mode 100644 index 0000000..63025e2 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb @@ -0,0 +1,450 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (subpath "/System/Library") + (regex #"^/private/var/containers/Bundle/[^/]+/[-0-9A-Z]+/Classroom.app") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (subpath-prefix "${HOME}/Library/studentd") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.studentd")) + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal-prefix "${HOME}/Library/Safari") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-journal") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-shm") +(literal-prefix "${HOME}/Library/Safari/Bookmarks.db-wal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-journal") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-shm") +(literal-prefix "${HOME}/Library/AddressBook/AddressBook.sqlitedb-wal") +(literal-prefix "${HOME}/Library/AddressBook")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (subpath-prefix "${HOME}/Library/WebClips") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (literal "/dev/dtracehelper") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/studentd") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.studentd")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath-prefix "${HOME}/Downloads/com.apple.AirDrop") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.logind.client.machService") + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.fig.movie") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.usymptomsd") + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (global-name "com.apple.springboard.services") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.springboard.icongeneration") + (global-name "com.apple.nesessionmanager") + (global-name "com.apple.CARenderServer") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.usernotifications.usernotificationservice") + (require-any (global-name "com.apple.GSSCred") +(global-name "com.apple.cookied") +(global-name "com.apple.nsurlstorage-cache")) + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.UIKit.statusbarserver") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.nsurlsessiond") + (global-name "com.apple.mediaremoted.xpc") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.wirelessproxd") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (global-name "com.apple.pluginkit.pkd") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.iokit.powerdxpc") + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.networkd") + (global-name "com.apple.commcenter.cupolicy.xpc") + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (global-name "com.apple.server.bluetooth.le.att.xpc") + (global-name "com.apple.managedconfiguration.profiled") + (global-name "com.apple.mobile.keybagd.xpc") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.accessibility.AXBackBoardServer") + (global-name "com.apple.accessibility.AXSpringBoardServer") + (global-name "com.apple.PowerManagement.control") + (global-name "com.apple.lsd.xpc") + (global-name "com.apple.mobile.keybagd.UserManager.xpc") + (global-name "com.apple.nehelper") + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.symptomsd") + (global-name "PurpleSystemEventPort") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (global-name "com.apple.trustd") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.ak.auth.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd.disable_opportunistic") + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface"))) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (require-any + (require-entitlement "com.apple.authkit.client.internal") + (require-entitlement "com.apple.authkit.client.private") + (require-entitlement "com.apple.authkit.client") + (require-all + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.Accessibility") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.itunesstored") + (extension "com.apple.security.exception.shared-preference.read-write") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mediaremote") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.studentd") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.studentd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/studentd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb new file mode 100644 index 0000000..2d6deb1 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb @@ -0,0 +1,563 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Mail") + (extension "com.apple.logd.read-only") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (subpath "/usr/share") + (subpath-prefix "${HOME}/Library/CallHistoryDB") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath-prefix "${HOME}/Library/Calendar") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.sandbox.executable") + (require-any (subpath-prefix "${HOME}/Library/ResponseKit") +(subpath-prefix "${HOME}/Library/Suggestions")) + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal-prefix "${HOME}/Library/SyncedPreferences/com.apple.CoreSuggestions.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Fonts") + (subpath-prefix "${FRONT_USER_HOME}/Library/Caches/GeoServices") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Data/System/com.apple.geod") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/dtracehelper") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/dev/ptmx") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (subpath "/private/var/MobileAsset") + (extension "com.apple.assets.read")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath-prefix "${HOME}/Library/Assets") + (extension "com.apple.assets.read")) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+/GeoServices/") + (subpath-prefix "${HOME}")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (literal-prefix "${HOME}/Library/Caches") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/euser[0-9]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/[-0-9A-F]+/Library/DeviceRegistry/[-0-9A-Z]+$" #"^/private/var/Users/[^/]+/Library/DeviceRegistry/[-0-9A-Z]+$") + (subpath-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Calendar") + (require-any (subpath-prefix "${HOME}/Library/ResponseKit") +(subpath-prefix "${HOME}/Library/Suggestions")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (require-not (literal-prefix "${HOME}/Library/Caches/GeoServices/tguid.bin")) + (require-any + (subpath-prefix "${HOME}/Library/Caches/com.apple.suggestd") + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.suggestd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/DeviceRegistry") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.locationd.spi") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.securityd") + (global-name "com.apple.coreduetd") + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.calaccessd") + (global-name "com.apple.reversetemplated") + (global-name "com.apple.syncdefaultsd") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.accountsd.accountmanager") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.mobileassetd") + (global-name "com.apple.aggregated") + (global-name "com.apple.CallHistorySyncHelper") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.rtcreportingd") + (global-name "com.apple.powerlog.plxpclogger.xpc") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.spotlight.IndexAgent") + (global-name "com.apple.commcenter.xpc") + (global-name "com.apple.locationd.synchronous") + (require-any (global-name "com.apple.geod") +(global-name "com.apple.nanomaps.xpc.GeoServices")) + (global-name "com.apple.corerecents.recentsd") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.carrier") + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.message") + (preference-domain "com.apple.suggestions") + (extension "com.apple.security.exception.shared-preference.read-only") + (require-any (preference-domain "com.apple.CoreSuggestions") +(preference-domain "com.apple.suggestd")) + (preference-domain "com.apple.CoreSuggestions.MobileAssets") + (preference-domain "com.apple.GEO") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.MobileAsset") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.mobilecal") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (preference-domain "com.apple.spotlightui") + (preference-domain "com.apple.DataMigration") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (require-any (preference-domain "com.apple.CoreSuggestions") +(preference-domain "com.apple.suggestd")) + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.suggestions")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/suggestd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb new file mode 100644 index 0000000..a484733 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb @@ -0,0 +1,427 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Cookies")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (subpath-prefix "${HOME}/Library/Cookies") + (literal "/private/etc/hosts") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (subpath "/private/var/Managed Preferences/mobile") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal-prefix "${HOME}/Library/Caches") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.syncdefaultsd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.syncdefaultsd") +(subpath-prefix "${HOME}/Library/SyncedPreferences")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-not (literal-prefix "${HOME}/Library/")) + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/private/var/preferences/com.apple.networkd.plist") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (literal "/") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (literal "/private/var/preferences/com.apple.security.plist") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (subpath "/private/var/preferences/Logging") + (subpath-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection")) + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-any (literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist") +(literal-prefix "${HOME}/Library/Caches/com.apple.persistentconnection.intervalcache.plist.lock") +(literal-prefix "${HOME}/Library/Caches/.com.apple.persistentconnection.settings.lock.lock")) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection/com.apple.syncdefaultsd") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection/com.apple.syncdefaultsd") +(subpath-prefix "${HOME}/Library/SyncedPreferences")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (subpath-prefix "${HOME}/Library/Cookies") + (subpath-prefix "${HOME}/Library/Caches/com.apple.syncdefaultsd") + (subpath-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/private/var/Managed Preferences/mobile") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/SyncedPreferences$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.syncdefaultsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (require-not (literal-prefix "${HOME}/Library/Logs/CrashReporter/CFNetwork_")) + (require-any + (require-all + (vnode-type DIRECTORY) + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/Logs/PersistentConnection") +(literal-prefix "${FRONT_USER_HOME}/Library/Logs/CrashReporter/PersistentConnection"))) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open) +(allow iokit-set-properties) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.accountsd") + (preference-domain "com.apple.persistentconnection") + (preference-domain "com.apple.WebFoundation") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.appleaccount") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow signal) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb.xml new file mode 100644 index 0000000..b54d51f --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syncdefaultsd.sb.xml @@ -0,0 +1,42 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb new file mode 100644 index 0000000..772baeb --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb @@ -0,0 +1,245 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/private/var/preferences/com.apple.security.plist") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/uuidtext") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (file-mode #o0001)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lockdown.host_watcher") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.securityd") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow mach-priv-task-port) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb.xml new file mode 100644 index 0000000..aa5dfc5 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/syslog_relay.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb new file mode 100644 index 0000000..1dce18b --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb @@ -0,0 +1,20 @@ +(version 1) +(deny default) +(allow file-link) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/test-common.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb new file mode 100644 index 0000000..a0fff23 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb @@ -0,0 +1,332 @@ +(version 1) +(deny default) +(allow file-read* + (subpath "/Developer") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath-prefix "${HOME}/Media/Vibrations") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath-prefix "${HOME}/Library/Fonts") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences/com.apple.mobilephone.speeddial.plist") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (subpath-prefix "${HOME}/Library/AddressBook") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal "/private/var") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Media/Vibrations") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (literal-prefix "${HOME}/Library/AddressBook/") + (extension "com.apple.tcc.kTCCServiceAddressBook") + (require-not (require-entitlement "com.apple.Contacts.database-deny"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (literal-prefix "${HOME}/Media") + (literal-prefix "${HOME}/Media/Vibrations")) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.cmfsyncagent.embedded.auth") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") + (global-name "com.apple.accountsd.accountmanager") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.ABDatabaseDoctor") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.identityservicesd.idquery.embedded.auth") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.diagnosticd") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.spotlight.IndexAgent") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.distributed_notifications@1v3") + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.AOSNotification.public.notbackedup") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.DataMigration") + (require-any (preference-domain "com.apple.CoreDuet") +(preference-domain "com.apple.PeoplePicker")) + (require-any (preference-domain "com.apple.icloud.findmydeviced.postwipe") +(preference-domain "com.apple.icloud.findmydeviced.public.notbackedup")) + (preference-domain "com.apple.AppSupport") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "kCFPreferencesAnyApplication") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb.xml new file mode 100644 index 0000000..7a76521 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/tonelibraryd.sb.xml @@ -0,0 +1,37 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb new file mode 100644 index 0000000..cae381e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb @@ -0,0 +1,114 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath "/private/var/spool/mdt") +(subpath-prefix "${HOME}/Library/Application Support/Containers") +(subpath-prefix "${HOME}/Library/Application Support/com.apple.mdt") +(subpath-prefix "${HOME}/Library/Inboxes")) + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Application Support") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (subpath-prefix "${HOME}/Downloads")) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/transitd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb new file mode 100644 index 0000000..397987e --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb @@ -0,0 +1,350 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (subpath "/private/var/personalized_automation/AppleInternal/Library") + (extension "com.apple.sandbox.executable")) +(allow file-read* + (subpath "/private/var/personalized_automation/AppleInternal/Library") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (require-any (subpath "/usr/local/etc/scripter") +(literal "/private/var/personalized_automation/usr/libexec") +(literal "/private/var/personalized_prod_automation/usr/libexec")) + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (subpath-prefix "${HOME}/Library/Logs/CrashReporter/UIALogs") +(subpath-prefix "${HOME}/Media/uiautomation") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.uiautomation")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (require-any (subpath-prefix "${HOME}/Library/Logs/CrashReporter/UIALogs") +(subpath-prefix "${HOME}/Media/uiautomation") +(subpath-prefix "${PROCESS_TEMP_DIR}/com.apple.uiautomation")) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.iphone.axserver-systemwide") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.usernotifications.usernotificationservice") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.lsd.mapdb") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.SystemConfiguration.configd") + (global-name "com.apple.aggregated") + (global-name "com.apple.springboard.services") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.iohideventsystem") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.notification_center") + (global-name "com.apple.frontboard.systemappservices") + (global-name "com.apple.CARenderServer") + (global-name "com.apple.commcenter.xpc") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.iphone.axserver") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.Sharing") + (preference-domain "com.apple.iokit.IOMobileGraphicsFamily") + (preference-domain "com.apple.purplebuddy") + (require-any (preference-domain "com.apple.Carousel") +(preference-domain "com.apple.UIAutomation")) + (preference-domain "com.apple.Accessibility") + (preference-domain "com.apple.UIKit") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.Accessibility") + (require-any (preference-domain "com.apple.Carousel") +(preference-domain "com.apple.UIAutomation")) + (preference-domain "com.apple.Sharing")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/uiautomationd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb new file mode 100644 index 0000000..afa4e07 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb @@ -0,0 +1,365 @@ +(version 1) +(deny default) +(allow file-ioctl + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/dev/ptmx") + (literal "/dev/aes_0")) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library"))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}/Library/Caches") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfs_helper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfs_helper")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (require-any (regex #"/dev/rdisk[0-9]") +(regex #"/dev/disk[0-9]")) + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty"))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfs_helper.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb new file mode 100644 index 0000000..0366e79 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb @@ -0,0 +1,435 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/db/timezone") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}/Library/Caches") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/Caches/com.apple.userfsd") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-all + (vnode-type DIRECTORY) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${HOME}/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.userfsd")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Caches"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.filesystems.userfs_helper") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-exec* + (require-any (literal "/System/Library/Filesystems/exfat.fs/Contents/Resources/fsck_exfat") +(literal "/System/Library/Filesystems/msdos.fs/Contents/Resources/fsck_msdos"))) +(allow process-fork) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb.xml new file mode 100644 index 0000000..93639f5 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/userfsd.sb.xml @@ -0,0 +1,39 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb new file mode 100644 index 0000000..bb5bfd8 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb @@ -0,0 +1,217 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (subpath "/System/Library") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${HOME}/Library/Application Support/com.apple.spotlight/subscriptions.plist") + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Application Support/videosubscriptionsd") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath-prefix "${HOME}/Library/Application Support/videosubscriptionsd") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/videosubscriptionsd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb new file mode 100644 index 0000000..aad5bb3 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb @@ -0,0 +1,471 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.nsurlstorage.extension-cache") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.wcd.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}"))))) +(allow file-link) +(allow file-map-executable + (require-any (subpath "/System/Library/Frameworks") +(subpath "/System/Library/PrivateFrameworks")) + (subpath "/Developer") + (subpath "/System/Library") + (subpath "/usr/lib") + (extension "com.apple.sandbox.executable") + (require-entitlement "com.apple.private.amfi.can-execute-cdhash") + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}"))) +(allow file-read* + (subpath "/usr/share") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.app-sandbox.read-write") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/private/var/preferences/com.apple.networkd.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (literal "/dev/aes_0") + (subpath "/System/Library") + (literal "/private/var/preferences/com.apple.security.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/Developer") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/dev/dtracehelper") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (extension "com.apple.app-sandbox.read") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath "/private/var/containers/Bundle/VPNPlugin") + (extension "com.apple.vpn-plugin")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesArtwork$") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/StoreKit$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/StoreKit$") + (subpath-prefix "${HOME}")) + (require-all + (require-not (vnode-type BLOCK-DEVICE)) + (require-not (vnode-type CHARACTER-DEVICE)) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-not (subpath "/private/var/containers")) + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal-prefix "${HOME}") + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (vnode-type DIRECTORY) + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/iTunesMetadata[.]plist$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.app-sandbox.read-write") + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/((tmp|Library)|Documents)$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container"))) +(allow file-write-data + (literal "/dev/aes_0") + (literal "/dev/ptmx") + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (extension "com.apple.sandbox.container") + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-get-properties) +(allow ipc-posix-sem*) +(allow ipc-posix-sem-create) +(allow ipc-posix-sem-open) +(allow ipc-posix-sem-post) +(allow ipc-posix-sem-unlink) +(allow ipc-posix-sem-wait) +(allow ipc-posix-shm*) +(allow ipc-posix-shm-read*) +(allow ipc-posix-shm-read-data) +(allow ipc-posix-shm-read-metadata) +(allow ipc-posix-shm-write*) +(allow ipc-posix-shm-write-create) +(allow ipc-posix-shm-write-data) +(allow ipc-posix-shm-write-unlink) +(allow mach-cross-domain-lookup) +(allow mach-lookup) +(allow mach-register + (global-name "com.f5.f5_sslvpn_plugin") + (require-all + (extension "com.apple.security.exception.mach-register.local-name") + (local-name-regex #".+")) + (require-all + (extension "com.apple.security.exception.mach-register.global-name") + (global-name-regex #".+"))) +(allow network*) +(allow network-inbound) +(allow network-bind) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb.xml new file mode 100644 index 0000000..15d1920 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/vpn-plugins.sb.xml @@ -0,0 +1,56 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb new file mode 100644 index 0000000..43b9146 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb @@ -0,0 +1,828 @@ +(version 1) +(deny default) +(allow file-issue-extension + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-only"))) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.executable")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (subpath "/System/Library")) + (require-all + (extension-class "com.apple.mediaserverd.read-write") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.sharing.airdrop.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.identityservices.send") + (require-any + (subpath-prefix "${PROCESS_TEMP_DIR}") + (require-all + (extension "com.apple.wcd.readonly") + (require-any + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/Applications") + (subpath "/private/var/containers/Bundle") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (subpath-prefix "${HOME}")))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Caches/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Caches/") + (subpath-prefix "${HOME}")))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.app-sandbox.read-write") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (extension-class "com.apple.nsurlsessiond.readonly") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.executable") + (extension-class "com.apple.nsurlsessiond.readonly") + (debug-mode)) + (require-all + (extension-class "com.apple.mediaserverd.read") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension-class "com.apple.mediaserverd.read") + (require-any + (extension "com.apple.security.exception.files.absolute-path.read-only") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (extension "com.apple.security.exception.files.home-relative-path.read-write"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension-class "com.apple.app-sandbox.read") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-link) +(allow file-read* + (subpath-prefix "${PROCESS_TEMP_DIR}") + (subpath "/System/Library") + (regex #"^/System/Library/Carrier Bundles/[.]png$" #"^/System/Library/Carrier Bundles/.+[.]png$") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (extension "com.apple.logd.read-only") + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/EffectiveUserSettings.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/EffectiveUserSettings.plist") +(literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/EffectiveUserSettings.plist")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/com.apple.carrier.plist") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (regex #"^/System/Library/Carrier Bundles//carrier[.]plist$" #"^/System/Library/Carrier Bundles/.+/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles/Overlay") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (literal "/dev/aes_0") + (subpath-prefix "${HOME}/Library/WatchConnectivity/Clients") + (subpath "/usr/libexec") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/usr/share") + (subpath "/private/var/preferences/Logging") + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles/[.]png$" #"^/private/var/mobile/Library/Carrier Bundles/.+[.]png$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*[.]png$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*[.]png$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (extension "com.apple.wcd.readonly") + (require-any + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (subpath "/Applications") + (subpath "/private/var/containers/Bundle") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/tmp$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/tmp$") + (subpath-prefix "${HOME}")) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")))) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (regex #"^/private/var/mobile/Library/Carrier Bundles//carrier[.]plist$" #"^/private/var/mobile/Library/Carrier Bundles/.+/carrier[.]plist$" #"^/private/var/euser[0-9]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/[-0-9A-F]+/Library/Carrier Bundles/.*/carrier[.]plist$" #"^/private/var/Users/[^/]+/Library/Carrier Bundles/.*/carrier[.]plist$") + (subpath-prefix "${FRONT_USER_HOME}")) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${HOME}")) + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (literal "/private/var/preferences/com.apple.networkd.plist") + (debug-mode)) + (require-all + (literal "/private/var/preferences/com.apple.security.plist") + (debug-mode)) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (literal "/private/var/preferences/com.apple.NetworkStatistics.plist") + (debug-mode)) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${HOME}")) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (subpath-prefix "${FRONT_USER_HOME}/Library/Carrier Bundles") + (literal-prefix "${HOME}/Library/PPTDevice") + (vnode-type DIRECTORY) + (literal-prefix "${HOME}/Library/Preferences") + (literal "/private/var/run/syslog") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/WatchConnectivity") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/WatchConnectivity") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")))) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (subpath-prefix "${HOME}/Library/WatchConnectivity/Clients") + (subpath-prefix "${PROCESS_TEMP_DIR}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${HOME}")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/"))) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/") + (subpath-prefix "${HOME}"))) +(allow file-write-create + (require-all + (vnode-type DIRECTORY) + (require-any + (literal-prefix "${HOME}/Library/WatchConnectivity") + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Documents/Inbox$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity/" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support/com[.]apple[.]watchconnectivity$") + (subpath-prefix "${HOME}")) + (require-all + (regex #"^/private/var/mobile/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/euser[0-9]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/[-0-9A-F]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$" #"^/private/var/Users/[^/]+/Containers/Data/[^/]+/[^/]+/Library/Application Support$") + (subpath-prefix "${HOME}")))) + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}"))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-unlink + (require-all + (vnode-type REGULAR-FILE) + (subpath-prefix "${PROCESS_TEMP_DIR}")) + (require-all + (extension "com.apple.identityservices.deliver") + (subpath-prefix "${FRONT_USER_HOME}/Library/IdentityServices"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleKeyStoreUserClient") + (extension "com.apple.security.exception.iokit-user-client-class")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "com.apple.system.libinfo.muser") + (global-name "com.apple.SBUserNotification") + (global-name "com.apple.locationd.registration") + (global-name "com.apple.FileCoordination") + (global-name "com.apple.assertiond.applicationstateconnection") + (debug-mode) + (global-name "com.apple.fig.movie") + (global-name "com.apple.itunescloudd.xpc") + (global-name "com.apple.frontboard.systemappservices") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.duetactivityscheduler") + (global-name "com.apple.diagnosticd") + (global-name "com.apple.coremedia.admin") + (global-name "com.apple.locationd.synchronous") + (global-name "com.apple.aggregated") + (require-any (global-name "com.apple.appconduitd.device-connection") +(global-name "com.apple.companionappd")) + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.coremedia.assetimagegenerator") +(global-name "com.apple.coremedia.assetimagegenerator.xpc") +(global-name "com.apple.coremedia.remotequeue") +(global-name "com.apple.coremedia.remaker")) + (require-any (global-name "com.apple.coremedia.asset") +(global-name "com.apple.coremedia.asset.xpc") +(global-name "com.apple.coremedia.figcontentkeysession.xpc")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.coreduetd") + (require-any (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") +(global-name "com.apple.pairedsyncd.syncstate")) + (global-name "com.apple.marco") + (global-name "com.apple.identityservicesd.embedded.auth") + (local-name "com.apple.cfprefsd.agent") + (global-name "com.apple.apsd") + (global-name "com.apple.itunesstored.xpc") + (global-name "com.apple.mediaserverd") + (global-name "com.apple.distributed_notifications@1v3") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.coremedia.figcpecryptor") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.locationd.spi") + (global-name "com.apple.coremedia.endpoint.xpc") + (global-name "com.apple.pegasus") + (require-any (global-name "com.apple.coremedia.assetcacheinspector") +(global-name "com.apple.coremedia.audiodeviceclock.xpc") +(global-name "com.apple.coremedia.audioprocessingtap.xpc") +(global-name "com.apple.coremedia.videocompositor") +(global-name "com.apple.coremedia.virtualframebuffer.xpc") +(global-name "com.apple.coremedia.systemcontroller.xpc") +(global-name "com.apple.coremedia.sandboxserver.xpc") +(global-name "com.apple.coremedia.capturesession") +(global-name "com.apple.coremedia.capturesource") +(global-name "com.apple.coremedia.recorder") +(global-name "com.apple.coremedia.player.xpc") +(global-name "com.apple.coremedia.formatreader.xpc")) + (global-name "com.apple.audio.AudioSession") + (global-name "com.apple.springboard.backgroundappservices") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (global-name "com.apple.coremedia.sandboxserver") + (require-all + (global-name "com.apple.cookied") + (debug-mode)) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (global-name "com.apple.networkd_privileged") + (require-any + (require-entitlement "com.apple.networkd_privileged") + (require-entitlement "com.apple.networkd.modify_settings") + (require-entitlement "com.apple.networkd.advisory_socket") + (require-entitlement "com.apple.networkd.persistent_interface") + (require-entitlement "com.apple.networkd.disable_opportunistic"))) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.accountsd.accountmanager") + (debug-mode)) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.SystemConfiguration.configd") + (debug-mode)) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.usymptomsd") + (debug-mode)) + (require-all + (require-any (global-name "com.apple.cfnetwork.AuthBrokerAgent") +(global-name "com.apple.cfnetwork.cfnetworkagent")) + (debug-mode)) + (require-all + (global-name "com.apple.securityd") + (debug-mode)) + (require-all + (global-name "com.apple.commcenter.xpc") + (debug-mode)) + (require-all + (global-name "com.apple.ak.auth.xpc") + (process-attribute 4) + (debug-mode)) + (require-all + (global-name "com.apple.networkd") + (debug-mode)) + (require-all + (global-name "com.apple.ak.anisette.xpc") + (process-attribute 4) + (debug-mode)) + (require-all + (global-name "com.apple.commcenter.cupolicy.xpc") + (debug-mode)) + (require-all + (global-name "com.apple.nesessionmanager") + (debug-mode)) + (require-all + (global-name "com.apple.nehelper") + (debug-mode)) + (require-all + (global-name "com.apple.GSSCred") + (debug-mode)) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (require-any (global-name "com.apple.SystemConfiguration.SCNetworkReachability") +(global-name "com.apple.SystemConfiguration.DNSConfiguration") +(global-name "com.apple.SystemConfiguration.NetworkInformation")) + (debug-mode)) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (global-name "com.apple.nsurlstorage-cache") + (debug-mode)) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.SystemConfiguration.helper") +(global-name "com.apple.SystemConfiguration.PPPController")) + (debug-mode)) + (require-all + (global-name "com.apple.symptomsd") + (debug-mode)) + (require-all + (global-name "com.apple.trustd") + (debug-mode)) + (require-all + (global-name "com.apple.nsurlsessiond") + (debug-mode)) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow network-outbound + (require-all + (require-not (literal "/private/var/tmp/launchd/sock")) + (require-any + (require-all + (debug-mode) + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$"))) + (require-all + (literal "/private/var/run/syslog") + (require-not (regex #"^/private/tmp/launchd-[0-9]+[.][^/]+/sock$")))))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (preference-domain "com.apple.carrier") + (preference-domain "com.apple.ids") + (extension "com.apple.security.exception.shared-preference.read-only") + (preference-domain "com.apple.corevideo") + (preference-domain "com.apple.locationd") + (preference-domain "com.apple.logging") + (preference-domain "kCFPreferencesAnyApplication") + (preference-domain "com.apple.itunesstored") + (preference-domain "com.apple.wcd") + (extension "com.apple.security.exception.shared-preference.read-write") + (preference-domain "com.apple.GEO") + (preference-domain "com.apple.mobileipod") + (preference-domain "com.apple.marco") + (require-any (preference-domain "com.apple.demo-settings") +(preference-domain "com.apple.pairedsync") +(preference-domain "com.apple.NanoRegistry")) + (preference-domain "com.apple.coreduet.complications.pushLimits") + (preference-domain "com.apple.coreaudio") + (preference-domain "com.apple.AppSupport") + (preference-domain "com.apple.coremedia") + (preference-domain "com.apple.avfoundation") + (preference-domain "com.apple.conference") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow user-preference-write + (preference-domain "com.apple.wcd")) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow sysctl-read + (extension "com.apple.security.exception.sysctl.read-write") + (extension "com.apple.security.exception.sysctl.read-only") + (require-all + (require-any (sysctl-name "kern.proc.") +(sysctl-name "kern.procargs2.")) + (require-entitlement "com.apple.security.exception.process-info")) + (require-all + (sysctl-name "sysctl.proc_native") + (require-any + (require-any (sysctl-name "vm.loadavg") +(sysctl-name "hw.busfrequency") +(sysctl-name "hw.busfrequency_compat") +(sysctl-name "hw.byteorder") +(sysctl-name "hw.activecpu") +(sysctl-name "hw.cachelinesize") +(sysctl-name "hw.cachelinesize_compat") +(sysctl-name "hw.cputype") +(sysctl-name "hw.cpusubtype") +(sysctl-name "hw.cpufrequency_max") +(sysctl-name "hw.cpufrequency_compat") +(sysctl-name "hw.cpufrequency") +(sysctl-name "hw.cpufamily") +(sysctl-name "hw.cpu64bit_capable") +(sysctl-name "hw.vectorunit") +(sysctl-name "hw.usermem") +(sysctl-name "hw.tbfrequency_compat") +(sysctl-name "hw.tbfrequency") +(sysctl-name "hw.physmem") +(sysctl-name "hw.physicalcpu_max") +(sysctl-name "hw.physicalcpu") +(sysctl-name "hw.pagesize_compat") +(sysctl-name "hw.pagesize") +(sysctl-name "hw.ncpu") +(sysctl-name "hw.model") +(sysctl-name "hw.memsize") +(sysctl-name "hw.logicalcpu_max") +(sysctl-name "hw.logicalcpu") +(sysctl-name "hw.l3settings") +(sysctl-name "hw.l3cachesize_compat") +(sysctl-name "hw.l3cachesize") +(sysctl-name "hw.l2settings") +(sysctl-name "hw.l2cachesize_compat") +(sysctl-name "hw.l2cachesize") +(sysctl-name "hw.l1icachesize_compat") +(sysctl-name "hw.l1icachesize") +(sysctl-name "hw.l1dcachesize_compat") +(sysctl-name "hw.l1dcachesize") +(sysctl-name "sysctl.name2oid") +(sysctl-name "security.mac.sandbox.sentinel") +(sysctl-name "kern.waketime") +(sysctl-name "kern.version") +(sysctl-name "kern.usrstack") +(sysctl-name "kern.secure_kernel") +(sysctl-name "kern.saved_ids") +(sysctl-name "kern.osversion") +(sysctl-name "kern.ostype") +(sysctl-name "kern.osrelease") +(sysctl-name "kern.ngroups") +(sysctl-name "kern.monotoniclock_offset_usecs") +(sysctl-name "kern.monotonicclock") +(sysctl-name "kern.memorystatus_level") +(sysctl-name "kern.maxproc") +(sysctl-name "kern.maxfilesperproc") +(sysctl-name "kern.hostid") +(sysctl-name "kern.development") +(sysctl-name "kern.clockrate") +(sysctl-name "kern.boottime") +(sysctl-name "kern.bootargs")) + (sysctl-name "kern.usrstack64") + (sysctl-name "hw.machine") + (sysctl-name "kern.hostname") + (sysctl-name "kern.maxvnodes"))) + (require-all + (sysctl-name "net.statistics") + (debug-mode)) + (require-all + (require-any (sysctl-name "kern.argmax") +(sysctl-name "kern.proc.pid.")) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (require-any (sysctl-name "kern.ipc.maxsockbuf") +(sysctl-name "kern.nisdomainname")) + (debug-mode)) + (require-all + (sysctl-name "net.routetable.") + (debug-mode))) +(allow system-privilege) +(allow system-socket + (require-all + (socket-domain AF_ROUTE) + (debug-mode))) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wcd.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb new file mode 100644 index 0000000..1c4315a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb @@ -0,0 +1,264 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (literal "/usr/libexec") + (require-any (subpath "/private/var/personalized_automation/Applications") +(regex #"/private/var/personalized_factory/[^/]+/Applications/?") +(subpath "/private/var/personalized_debug/Applications") +(regex #"/private/var/factory_mount/[^/]+/Applications/?") +(subpath "/private/var/factory_mount/AppleInternal/Applications") +(subpath "/private/var/factory_mount/Developer/Applications")) + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/System") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/private/var/containers/Bundle") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (subpath "/Developer") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (subpath "/usr/share") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (subpath "/Applications") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (debug-mode) + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts")) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-read-metadata + (vnode-type SYMLINK) + (literal "/private/var/run/syslog") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (literal-prefix "${HOME}/Library/Caches/powerlog.launchd") + (literal-prefix "${HOME}") + (literal-prefix "${HOME}/Library/Preferences") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (literal-prefix "${HOME}") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (vnode-type DIRECTORY) + (require-entitlement "com.apple.bulletinboard.dataprovider") + (require-all + (literal-prefix "${HOME}") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (vnode-type DIRECTORY) + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (literal-prefix "${HOME}/Library/Preferences") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (global-name "PurpleSystemEventPort") + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.assertiond.applicationstateconnection") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.springboard.backgroundappservices") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow user-preference-read + (require-any (preference-domain "com.apple.webinspectord") +(preference-domain "com.apple.WebInspector")) + (preference-domain "kCFPreferencesAnyApplication") + (extension "com.apple.security.exception.shared-preference.read-only") + (extension "com.apple.security.exception.shared-preference.read-write") + (require-all + (preference-domain "com.apple.demo-settings") + (process-attribute 4) + (require-not (require-entitlement "com.apple.private.amfi.can-execute-cdhash"))) + (require-all + (preference-domain "com.apple.bulletinboard") + (require-entitlement "com.apple.bulletinboard.dataprovider"))) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/webinspectord.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb new file mode 100644 index 0000000..897ed7a --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb @@ -0,0 +1,263 @@ +(version 1) +(deny default) +(allow file-link) +(allow file-read* + (subpath "/Developer") + (require-any (literal "/usr/libexec/wifiFirmwareLoaderLegacy") +(literal "/usr/libexec/wifiFirmwareLoader") +(subpath "/usr/share/firmware/wifi") +(subpath "/usr/share/zoneinfo.default") +(literal "/private/var/Managed Preferences/mobile/com.apple.wifiFirmwareLoader.plist")) + (literal "/private/var/preferences/SystemConfiguration/com.apple.wifi.plist") + (literal "/dev/aes_0") + (extension "com.apple.logd.read-only") + (literal "/dev/ptmx") + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist") + (subpath "/usr/share") + (subpath "/System/Library") + (require-any (subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.icloud.findmydevice.managed/Library") +(subpath "/private/var/db/datadetectors/sys")) + (literal "/usr/libexec") + (require-any (subpath-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/PublicInfo") +(subpath-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/PublicInfo") +(subpath "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")) + (require-any (literal "/dev/null") +(literal "/dev/zero")) + (subpath "/AppleInternal") + (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist") + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.absolute-path.read-only") + (subpath "/private/var/preferences/Logging") + (subpath "/usr/lib") + (subpath "/private/var/db/timezone") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (require-any (literal "/dev/urandom") +(literal "/dev/random")) + (extension "com.apple.sandbox.executable") + (literal-prefix "${FRONT_USER_HOME}/Library/Preferences/.GlobalPreferences.plist") + (extension "com.apple.security.exception.files.home-relative-path.read-only") + (literal "/dev/dtracehelper") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (subpath-prefix "${FRONT_USER_HOME}/XcodeBuiltProducts") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (subpath "/private/var/db/uuidtext") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/AppleInternal") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$"))) + (require-all + (literal "/private/etc/master.passwd") + (uid 0)) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (vnode-type BLOCK-DEVICE) + (vnode-type CHARACTER-DEVICE) + (require-any + (literal "/private/etc/hosts") + (require-any (literal "/private/etc/group") +(literal "/private/etc/passwd") +(literal "/private/etc/protocols") +(literal "/private/etc/services")) + (literal "/") + (require-all + (literal "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db") +(literal-prefix "${HOME}/Library/CoreDuet/People")) + (require-entitlement "com.apple.coreduetd.people")) + (require-all + (require-any (literal-prefix "${FRONT_USER_HOME}/Library/ConfigurationProfiles/CloudConfigurationDetails.plist") +(literal-prefix "${FRONT_USER_HOME}/Library/UserConfigurationProfiles/CloudConfigurationDetails.plist")) + (process-attribute 4) + (require-entitlement "com.apple.private.amfi.can-execute-cdhash")) + (require-all + (require-any (literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-journal") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-shm") +(literal-prefix "${HOME}/Library/CoreDuet/People/interactionC.db-wal")) + (require-entitlement "com.apple.coreduetd.people")))) + (require-all + (subpath "/private/var/db/diagnostics") + (require-any + (require-entitlement "com.apple.diagnosticd.diagnostic") + (require-entitlement "com.apple.private.logging.diagnostic"))) + (require-all + (subpath "/usr/local/lib") + (debug-mode)) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write* + (literal "/private/var/logs/wifiFirmwareLoader.log") + (extension "com.apple.security.exception.files.absolute-path.read-write") + (regex #"^/private/var/containers/Data/System/[^/]+/") + (extension "com.apple.security.exception.files.home-relative-path.read-write") + (require-all + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/") + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/")))) +(allow file-write-data + (literal "/dev/ptmx") + (literal "/dev/aes_0") + (require-all + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+") + (extension "com.apple.sandbox.pty")) + (require-all + (vnode-type TTY) + (require-any (regex #"/dev/ttyp[a-f0-9]") +(regex #"/dev/ptyp[a-f0-9]"))) + (require-all + (require-all (require-not (literal "/dev/urandom")) +(require-not (literal "/dev/random"))) + (require-any + (literal "/dev/dtracehelper") + (require-any (literal "/dev/null") +(literal "/dev/zero"))))) +(allow file-write-mode + (require-all + (extension "com.apple.sandbox.pty") + (regex #"^/dev/ttys[0-9]" #"^/dev/ttys[0-9]+"))) +(allow file-write-xattr + (regex #"^/private/var/containers/Data/System/[^/]+/" #"^/private/var/containers/Data/System/[^/]+$") + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-container") + (require-entitlement "com.apple.security.system-container")) + (require-all + (xattr "com.apple.metadata:com_apple_backup_excludeItem") + (extension "com.apple.sandbox.system-group") + (require-any + (require-entitlement "com.apple.security.system-groups") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$") + (require-entitlement "com.apple.security.system-group-containers") + (regex #"^/private/var/containers/Shared/SystemGroup/[^/]+/" #"^/private/var/containers/Shared/SystemGroup/[^/]+$")))) +(allow iokit-open + (iokit-user-client-class "AppleBCMWLANUserClient")) +(allow iokit-get-properties) +(allow mach-cross-domain-lookup) +(allow mach-lookup + (global-name "com.apple.distributed_notifications@1v3") + (require-any (global-name "com.apple.hangtracerd") +(global-name "com.apple.ReportCrash.SimulateCrash")) + (require-any (global-name "com.apple.cfprefsd.daemon") +(global-name "com.apple.cfprefsd.agent") +(global-name "com.apple.logd") +(global-name "com.apple.system.logger")) + (global-name "com.apple.system.libinfo.muser") + (require-any (global-name "com.apple.tccd") +(global-name "com.apple.lsd.advertisingidentifiers") +(global-name "com.apple.lsd.openurl")) + (global-name "com.apple.diagnosticd") + (global-name "com.apple.lsd.mapdb") + (global-name "com.apple.aggregated") + (global-name "com.apple.mobilegestalt.xpc") + (global-name "com.apple.system.notification_center") + (require-any (global-name "com.apple.ctkd.token-client") +(global-name "com.apple.CoreAuthentication.daemon.libxpc") +(global-name "com.apple.managedconfiguration.profiled.public")) + (global-name "com.apple.corecaptured") + (require-any (global-name "com.apple.duetknowledged.activity") +(global-name "com.apple.lsd") +(global-name "com.apple.lsd.icons") +(global-name "com.apple.lsd.open") +(global-name "com.apple.appsupport.cplogd") +(global-name "com.apple.assertiond.processassertionconnection") +(global-name "com.apple.xpcd") +(global-name "com.apple.coreservices.lsuseractivitymanager.xpc")) + (local-name "com.apple.cfprefsd.agent") + (require-any (global-name "com.apple.containermanagerd") +(global-name "com.apple.logd.events")) + (require-all + (global-name "com.apple.itunesstored.xpc") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.appstored.install-apps")) + (require-all + (extension "com.apple.security.exception.mach-lookup.local-name") + (local-name-regex #".+")) + (require-all + (global-name "com.apple.logd.admin") + (require-any + (require-entitlement "com.apple.private.logging.diagnostic") + (require-entitlement "com.apple.diagnosticd.diagnostic"))) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.appstored.update-apps")) + (require-all + (global-name "com.apple.appstored.xpc.updates") + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.passd.trusted-device-enrollment-info-provider") + (require-entitlement "com.apple.private.passkit.trusted-device-enrollment-info")) + (require-all + (global-name "com.apple.bulletinboard.dataproviderconnection") + (require-entitlement "com.apple.bulletinboard.dataprovider")) + (require-all + (require-any (global-name "com.apple.appstored.xpc.jobmanager") +(global-name "com.apple.appstored.xpc.request")) + (require-entitlement "com.apple.itunesstored.private")) + (require-all + (global-name "com.apple.symptom_diagnostics") + (require-entitlement "com.apple.symptom_diagnostics.report")) + (require-all + (global-name "com.apple.springboard.statusbarservices") + (require-entitlement "com.apple.springboard.statusbarstyleoverrides")) + (require-all + (extension "com.apple.security.exception.mach-lookup.global-name") + (global-name-regex #".+")) + (require-all + (global-name "com.apple.coreduetd.people") + (require-entitlement "com.apple.coreduetd.people"))) +(allow nvram*) +(allow nvram-delete) +(allow nvram-get) +(allow nvram-set) +(allow process-info*) +(allow process-info-codesignature) +(allow process-info-dirtycontrol) +(allow process-info-listpids) +(allow process-info-rusage) +(allow process-info-pidinfo) +(allow process-info-pidfdinfo) +(allow process-info-pidfileportinfo) +(allow process-info-setcontrol) +(allow pseudo-tty) +(allow system-privilege) diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb.xml b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb.xml new file mode 100644 index 0000000..f38f845 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/rev_profiles/wifiFirmwareLoader.sb.xml @@ -0,0 +1,38 @@ + + + + + + + + + +]> + + + + + + + + + + + + + + + + + + + + + diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_bundle b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_bundle new file mode 100644 index 0000000..c6e5e20 Binary files /dev/null and b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_bundle differ diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_profiles.txt b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_profiles.txt new file mode 100644 index 0000000..fa78814 --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sandbox_profiles.txt @@ -0,0 +1,140 @@ +AGXCompilerService +AdSheet +AirTraffic +AnnotationKit.MigratorService +BTServer +BlueTool +CFNetworkAgent +CPLDiagnose +CVMServer +CacheDeleteAppContainerCaches +CommCenter +DataActivation +EscrowSecurityAlert +IDSCredentialsAgent +IDSRemoteURLConnectionAgent +IMDPersistenceAgent +IMRemoteURLConnectionAgent +IMTranscoderAgent +MTLCompilerService +MailCompositionService +MobileBackup +MobileSlideShow +PasteBoard +SafariSafeBrowsing +ScreenSharingServer +ScreenshotService +StreamingUnzipService +VideoSubscriberAccountDeveloperService +VideoSubscriberAccountPrivacyService +WebSheet +afcd +appconduitd +apsd +assertiond +bulletindistributord +cloudphotod +com.apple.AssetCacheLocatorService +com.apple.GSSCred +com.apple.WebKit.Databases +com.apple.WebKit.Networking +com.apple.WebKit.WebContent +com.apple.assistant.assistantd +com.apple.bird +com.apple.captiveagent +com.apple.cloudd +com.apple.datadetectors.AddToRecentsService +com.apple.homed +com.apple.nehelper +com.apple.nesessionmanager +com.apple.networkserviceproxy +com.apple.quicklook.QLThumbnailsService +com.apple.rtcreportingd +com.apple.sandboxd +com.apple.siri.ClientFlow.ClientScripter +com.apple.snhelper +com.apple.tccd +com.apple.tzlinkd +com.apple.ubd +com.apple.wirelessproxd +container +containermanagerd +coresymbolicationd +cplogd +ctkd +dataaccessd +datadetectors +debugserver +deleted +duetexpertd +findmydeviced +fmfd +ftp-proxy-embedded +gamed +geocorrectiond +geod +gizmoappd +gputoolsd +healthcloudd +healthd +iapd +identityservicesd +installd +itunesstored +keyboard +librariand +limitadtrackingd +lockdownd +logd +lsuseractivityd +mDNSResponder +mediaanalysisd +mediaserverd +mobile-house-arrest +mobileactivationd +mobileassetd +nanomapscd +navd +network-filter +nfcd +nlcd +nointernet +nsurlsessiond +nsurlstoraged +online-auth-agent +parsecd +passd +personad +pfd +photoanalysisd +playground-devtools +powerlogd +printd +ptpd +quicklookd +racoon +replayd +reversetemplated +revisiond +routined +securityd +seld +sharingd +social-services +softwareupdated +streaming_zip_conduit +studentd +suggestd +syncdefaultsd +syslog_relay +test-common +tonelibraryd +transitd +uiautomationd +userfs_helper +userfsd +videosubscriptionsd +vpn-plugins +wcd +webinspectord +wifiFirmwareLoader diff --git a/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sb_ops b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sb_ops new file mode 100644 index 0000000..8fe94ab --- /dev/null +++ b/tests/iPhone_4.0_64bit_10.3.3_14G60/references/sb_ops @@ -0,0 +1,137 @@ +default +appleevent-send +authorization-right-obtain +boot-arg-set +device* +device-camera +device-microphone +distributed-notification-post +file* +file-chroot +file-ioctl +file-issue-extension +file-link +file-map-executable +file-mknod +file-mount +file-mount-update +file-read* +file-read-data +file-read-metadata +file-read-xattr +file-revoke +file-search +file-unmount +file-write* +file-write-acl +file-write-create +file-write-data +file-write-flags +file-write-mode +file-write-owner +file-write-setugid +file-write-times +file-write-unlink +file-write-xattr +fs-snapshot* +fs-snapshot-create +fs-snapshot-delete +fs-snapshot-revert +generic-issue-extension +qtn-user +hid-control +iokit* +iokit-issue-extension +iokit-open +iokit-set-properties +iokit-get-properties +ipc* +ipc-posix* +ipc-posix-issue-extension +ipc-posix-sem* +ipc-posix-sem-create +ipc-posix-sem-open +ipc-posix-sem-post +ipc-posix-sem-unlink +ipc-posix-sem-wait +ipc-posix-shm* +ipc-posix-shm-read* +ipc-posix-shm-read-data +ipc-posix-shm-read-metadata +ipc-posix-shm-write* +ipc-posix-shm-write-create +ipc-posix-shm-write-data +ipc-posix-shm-write-unlink +ipc-sysv* +ipc-sysv-msg +ipc-sysv-sem +ipc-sysv-shm +job-creation +load-unsigned-code +lsopen +mach* +mach-cross-domain-lookup +mach-host* +mach-host-exception-port-set +mach-host-special-port-set +mach-issue-extension +mach-lookup +mach-per-user-lookup +mach-priv* +mach-priv-host-port +mach-priv-task-port +mach-register +mach-task-name +network* +network-inbound +network-bind +network-outbound +nvram* +nvram-delete +nvram-get +nvram-set +user-preference* +user-preference-read +user-preference-write +process* +process-codesigning-status* +process-codesigning-status-set +process-codesigning-status-get +process-exec* +process-exec-interpreter +process-fork +process-info* +process-info-codesignature +process-info-dirtycontrol +process-info-listpids +process-info-rusage +process-info-pidinfo +process-info-pidfdinfo +process-info-pidfileportinfo +process-info-setcontrol +pseudo-tty +signal +sysctl* +sysctl-read +sysctl-write +system* +system-acct +system-audit +system-chud +system-debug +system-fsctl +system-info +system-kext* +system-kext-load +system-kext-unload +system-kext-query +system-mac-label +system-nfssvc +system-package-check +system-privilege +system-reboot +system-sched +system-set-time +system-socket +system-suspend-resume +system-swap diff --git a/tests/test.py b/tests/test.py new file mode 100755 index 0000000..abe227c --- /dev/null +++ b/tests/test.py @@ -0,0 +1,286 @@ +#!/usr/bin/env python3 + +import os +import pathlib +import subprocess +from datetime import datetime + +DIRNAME = os.path.dirname(os.path.abspath(__file__)) +MAINDIR = os.path.dirname(DIRNAME) + + +def compare_directories(actual: pathlib.Path, expected: pathlib.Path, log_file): + actual_files = sorted( + f.relative_to(actual) for f in actual.rglob("*") if f.is_file() + ) + expected_files = sorted( + f.relative_to(expected) for f in expected.rglob("*") if f.is_file() + ) + + assert actual_files == expected_files, "Mismatch in file names/structure" + + for rel_path in actual_files: + # skip sb files as they are checked separately + if rel_path.suffix == ".sb": + continue + + else: + actual_content = (actual / rel_path).read_bytes() + expected_content = (expected / rel_path).read_bytes() + assert actual_content == expected_content, f"Mismatch in file: {rel_path}" + + parser_proc = subprocess.run( + [ + os.path.join(MAINDIR, "sb_parser", "parser"), + (actual / "rev_profiles"), + (expected / "rev_profiles"), + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + assert parser_proc.returncode == 0, "Mismatch in sb files" + + +def build_image(): + name = f'sandblaster_{datetime.now().strftime("%d_%m_%Y__%H_%M_%S")}' + + log_path = os.path.join(DIRNAME, "build_logs", f"{name}.log") + log_file = open(log_path, "w") + + docker_build_process = subprocess.run( + ["docker", "build", "-t", name, MAINDIR], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + if docker_build_process.returncode != 0: + print( + f"[ERROR] Docker build failed, check build_logs/{name}.log for more details :(" + ) + return 1 + + print(f"[INFO] Docker build {name} successful") + return name + + +def remove_image(container_name): + print(f"[INFO] Removing container {container_name}") + + subprocess.run(["docker", "rmi", "-f", container_name]) + + +def start_run(container_name, test_name): + run_name = f"run_{container_name}_{test_name}" + + test_path = os.path.join(DIRNAME, test_name) + + run_process = subprocess.run( + [ + "docker", + "run", + "-v", + f"{test_path}:/test", + "--rm", + "-dit", + "--name", + run_name, + container_name, + ], + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + ) + + print(f"[INFO] Run ID: {run_process.stdout}") + + return run_name + + +def stop_run(run_name): + stop_process = subprocess.run( + ["docker", "stop", run_name], stdout=subprocess.PIPE, stderr=subprocess.STDOUT + ) + + print(f"[INFO] Stopped run {stop_process.stdout}") + + +def generic_test( + container_name, test_name, ios_major_version, ios_version, update_refs=False +): + print(f"[INFO] Running sandblaster test {test_name} (iOS v{ios_major_version})...") + + run_name = start_run(container_name, test_name) + + log_path = os.path.join(DIRNAME, test_name, "logs", f"{run_name}.log") + log_file = open(log_path, "a") + + subprocess.run( + ["docker", "exec", run_name, "rm", "-rf", "/test/outputs"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + ["docker", "exec", run_name, "mkdir", "/test/outputs"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + [ + "docker", + "exec", + run_name, + "/sandblaster/helpers/extract_sandbox_data.py", + "-o", + "/test/outputs/sb_ops", + "/test/inputs/sandbox.kext", + ios_version, + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + if ios_major_version >= 9: + subprocess.run( + [ + "docker", + "exec", + run_name, + "/sandblaster/helpers/extract_sandbox_data.py", + "-O", + "/test/outputs", + "/test/inputs/sandbox.kext", + ios_version, + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + else: + subprocess.run( + ["docker", "exec", run_name, "mkdir", "-p", "/test/outputs/sb_profiles"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + [ + "docker", + "exec", + run_name, + "/sandblaster/helpers/extract_sandbox_data.py", + "-O", + "/test/outputs/sb_profiles", + "/test/inputs/sandboxd", + ios_version, + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + ["docker", "exec", run_name, "mkdir", "/test/outputs/rev_profiles"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + if ios_major_version >= 9: + subprocess.run( + [ + "docker", + "exec", + run_name, + "sh", + "-c", + f"cd /sandblaster/reverse-sandbox/ && python2.7 reverse_sandbox.py -r {ios_version} " + + "-o /test/outputs/sb_ops -d /test/outputs/rev_profiles/ /test/outputs/sandbox_bundle " + + "-psb > /test/outputs/sandbox_profiles.txt", + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + [ + "docker", + "exec", + run_name, + "sh", + "-c", + f"cd /sandblaster/reverse-sandbox/ && python2.7 reverse_sandbox.py -r {ios_version} " + + "-o /test/outputs/sb_ops -d /test/outputs/rev_profiles/ /test/outputs/sandbox_bundle", + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + else: + subprocess.run( + [ + "docker", + "exec", + run_name, + "sh", + "-c", + "cd /sandblaster/reverse-sandbox/ && for i in /test/outputs/sb_profiles/*; do " + + f"python2.7 reverse_sandbox.py -r {ios_version} -o /test/outputs/sb_ops -d " + + '/test/outputs/rev_profiles/ "$i"; done', + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + if update_refs: + subprocess.run( + ["docker", "exec", run_name, "rm", "-rf", "/test/references"], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + subprocess.run( + [ + "docker", + "exec", + run_name, + "cp", + "-r", + "/test/outputs", + "/test/references", + ], + stdout=log_file, + stderr=subprocess.STDOUT, + ) + + return + + print(f"[INFO] {test_name}: comparing results...") + + output_dir = pathlib.Path(DIRNAME, test_name, "outputs") + reference_dir = pathlib.Path(DIRNAME, test_name, "references") + + try: + compare_directories(output_dir, reference_dir, log_file) + + print(f"[PASS] {test_name} :)") + except AssertionError as err: + print(f"[FAIL] {test_name} - {err}") + + stop_run(run_name) + + +def main(): + container_name = build_image() + + generic_test(container_name, "iPad2__1_8.4.1_12H321", 8, ios_version="8.4.1") + + generic_test(container_name, "iPhone5__1_9.3_13E237", 9, ios_version="9.3") + + generic_test( + container_name, "iPhone_4.0_64bit_10.3.3_14G60", 10, ios_version="10.3.3" + ) + + generic_test(container_name, "iPhone6__2_11.0.0_15A372", 11, ios_version="11.0.0") + + remove_image(container_name) + + +main()